Chrome Version       : 63.0.3239.18 
OS: Debian (inside docker container), unstable version installed through official repository
Other browsers tested:
  Add OK or FAIL, along with the version, after other browsers where you
have tested this issue:
     Safari: n/a
    Firefox: n/a
         IE: n/a

What steps will reproduce the problem?
(1) Save attached file crash.html on disk
(2) Use puppeteer to create screenshot of the attached file chrash.html
(3) Chrome chrashes with the following stackrace

Received signal 7 BUS_ADRERR 7f6eb8270000
#0 0x55e6db227857 base::debug::StackTrace::StackTrace()
#1 0x55e6db2273bf base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7f6ed55070c0 <unknown>
#3 0x7f6ecf26ee5f <unknown>
#4 0x55e6dd53e28e blink::ImageFrameGenerator::DecodeAndScale()
#5 0x55e6dd52b22a blink::DecodingImageGenerator::GetPixels()
#6 0x55e6db8a70b1 cc::PaintImage::Decode()
#7 0x55e6dbf26666 cc::SoftwareImageDecodeCache::GetExactSizeImageDecode()
#8 0x55e6dbf25e7b cc::SoftwareImageDecodeCache::DecodeImageInternal()
#9 0x55e6dbf2594e cc::SoftwareImageDecodeCache::DecodeImage()
#10 0x55e6dbf2992c cc::(anonymous namespace)::ImageDecodeTaskImpl::RunOnWorkerThread()
#11 0x55e6de7efb57 content::CategorizedWorkerPool::RunTaskInCategoryWithLockAcquired()
#12 0x55e6de7eec9a content::CategorizedWorkerPool::Run()
#13 0x55e6db28d050 base::SimpleThread::ThreadMain()
#14 0x55e6db288c63 base::(anonymous namespace)::ThreadFunc()
#15 0x7f6ed54fd494 start_thread
#16 0x7f6ecf22eaff clone
  r8: 0000000000000000  r9: 00002dab62d7f280 r10: 0000000000001320 r11: 0000000000000007
 r12: 0000000000004c80 r13: 0000000000004c80 r14: 00007f6ec1656638 r15: 000000000000006c
  di: 00007f6eb8270000  si: 00002dab62d7e000  bp: 00002dab62d7a600  bx: 00007f6eb826c600
  dx: 0000000000004c80  ax: 00007f6eb826c600  cx: 0000000000001280  sp: 00007f6ec1656438
  ip: 00007f6ecf26ee5f efl: 0000000000010202 cgf: 0000000000000033 erf: 0000000000000006
 trp: 000000000000000e msk: 0000000000000000 cr2: 00007f6eb8270000
[end of stack trace]

What is the expected result?
Screenshot should be taken and

What happens instead?

A crash.

Please provide any additional information below. Attach a screenshot if
possible.

I narrowed it down to the weird, long image URL in the CSS. If you remove this line, the screenshot is generated fine. If you use an URL with no malformed "amp" escapes, it also works.
 

Deleted: crash.html 609 bytes

crash.html 609 bytes View Download