third_party/WebKit/LayoutTests/fast/dom/move-style-element-to-inactive-document-crash.html

   1 <!DOCTYPE html>
   2 <body>
   3 <script>
   4 if (window.testRunner)
   5     testRunner.dumpAsText();
   6
   7 onload = function() {
   8     var style = document.createElement("style");
   9     document.body.appendChild(style);
  10     var option = document.createElement("option");
  11
  12     var newdoc = document.implementation.createDocument("", null);
  13     newdoc.appendChild(document.body);
  14     style.appendChild(option);
  15
  16     document.body = document.createElement('body');
  17     document.body.innerHTML = 'PASS if no crash.';
  18 }
  19 </script>
  20 </body>
  21