third_party/blink/web_tests/paint/invalidation/cull-rect-change-crash.html

<!doctype HTML>
<script src="resources/text-based-repaint.js"></script>
<svg style="position: absolute; left: 0px; height: 200px">
   <g id="g" transform="scale(0.001)">
    <foreignobject height="100" width="100">
       PASS
      </p>
    <script>
    function repaintTest() {
        document.getElementById("g").setAttribute('transform', 'scale(-5)');
    }
</script>
<script>
   if (window.internals)
    internals.runtimeFlags.paintUnderInvalidationCheckingEnabled = true;
  runRepaintTest()
 
</script>