third_party/WebKit/LayoutTests/fast/dom/insertedIntoDocument-no-crash.html

   1 <html>
   2 <p>This test must not crash.</p>
   3 <script>
   4 if (window.testRunner)
   5     testRunner.dumpAsText();
   6
   7 function f1() {
   8     document.write('<form>'); //Here we need the form tag to trigger the bug
   9     document.getElementsByTagName("s")[0].innerHTML = 'foo';
  10 }
  11
  12 function f2() {
  13     try {
  14         document.getElementsByTagName("kbd")[0].innerHTML = 'foo';
  15         document.getElementsByTagName("kbd")[0].insertBefore(document.createElement('foo'),document.createElement('foo'));
  16     } catch (e) {
  17         // We are not interested in exceptions.
  18     }
  19 }
  20 </script>
  21 <s>
  22 <!-- The following weird mark-up is needed to reproduce the crash -->
  23 <script>f1();</script>
  24 <xmp><mark>
  25 <script>f1();</script>
  26 <xmp></xmp>
  27 <kbd>
  28 <script>f2();</script>
  29 </kbd>
  30 </s>
  31 </html>