third_party/WebKit/LayoutTests/fast/dom/document-set-title-mutation-crash.html

   1 <!DOCTYPE html>
   2 <html>
   3 <script>
   4 var count = 0;
   5 if (!window.testRunner)
   6     document.write("This test requires GCController.");
   7 else {
   8     testRunner.dumpAsText();
   9     testRunner.waitUntilDone();
  10
  11     function crash() {
  12         if (++count > 1)
  13             return;
  14         document.open();
  15         document.write('PASS');
  16         document.close();
  17         GCController.collect();
  18         setTimeout("testRunner.notifyDone()", 0);
  19     }
  20
  21     setTimeout(function () {
  22         document.write("<title>");
  23         document.title = "First Child";
  24         document.getElementsByTagName('title')[0].appendChild(document.createTextNode("Second Child"));
  25
  26         document.addEventListener('DOMNodeRemovedFromDocument', function () { crash(); }, true);
  27         document.title = "New title";
  28     }, 0);
  29 }
  30 </script>
  31 </html>