third_party/WebKit/LayoutTests/fast/layout/subtree-layout-with-javascript-navigate-crash.html

   1 <!DOCTYPE html>
   2 <body>
   3 Test passes if no crash with ASAN.
   4 <input value="boom">
   5 <script>
   6 if (window.testRunner) {
   7   testRunner.waitUntilDone();
   8   testRunner.dumpAsText();
   9 }
  10
  11 var input = document.getElementsByTagName('input')[0];
  12 function explode() {
  13   var value = input.value;
  14   if (value) {
  15     input.value = value.substr(0, value.length - 1);
  16     window.setTimeout(explode, 0);
  17   } else {
  18     window.location.href="javascript:''";
  19     if (window.testRunner)
  20       testRunner.notifyDone();
  21   }
  22 }
  23 explode();
  24 </script>