tests/tests/webkitsecurity/assets/pending-reflection-mask-crash.html

<style>
  *{
    -webkit-box-reflect: none !important;
    -webkit-box-reflect: below 0 url(x);
  }
</style>
<script>
    if (window.layoutTestController)
        layoutTestController.dumpAsText();
</script>
<p>This test should not crash.</p>