third_party/WebKit/LayoutTests/fast/parser/nested-fragment-parser-crash.html

   1 x<h4><strike>x
   2 This test passes if it doesn't crash.
   3 <script>
   4   if (window.testRunner)
   5     testRunner.dumpAsText();
   6
   7   var counter = 0;
   8   window.onload=function(){
   9     document.execCommand("SelectAll");
  10     document.designMode="on";
  11     document.execCommand("Indent");
  12     document.execCommand("InsertOrderedList", false);
  13   };
  14   function handler() {
  15     // This constant is somewhat magic. It's the smallest constant such that
  16     // we'll exceed the maxium call stack size.
  17     if (++counter >= 34)
  18       document.removeEventListener("DOMSubtreeModified", handler, false);
  19     document.execCommand("outdent", false);
  20   };
  21   document.addEventListener("DOMSubtreeModified", handler, false);
  22 </script>