src/third_party/WebKit/LayoutTests/fast/dom/document-set-title-mutation-crash.html

   1 <!DOCTYPE html>\r
   2 <html>\r
   3 <script>\r
   4 var count = 0;\r
   5 if (!window.testRunner)\r
   6     document.write("This test requires GCController.");\r
   7 else {\r
   8     testRunner.dumpAsText();\r
   9     testRunner.waitUntilDone();\r
  10 \r
  11     function crash() {\r
  12         if (++count > 1)\r
  13             return;\r
  14         document.open();\r
  15         document.write('PASS');\r
  16         document.close();\r
  17         GCController.collect();\r
  18         setTimeout("testRunner.notifyDone()", 0);\r
  19     }\r
  20 \r
  21     setTimeout(function () {\r
  22         document.write("<title>");\r
  23         document.title = "First Child";\r
  24         document.getElementsByTagName('title')[0].appendChild(document.createTextNode("Second Child"));\r
  25 \r
  26         document.addEventListener('DOMNodeRemovedFromDocument', function () { crash(); }, true);\r
  27         document.title = "New title";\r
  28     }, 0);\r
  29 }\r
  30 </script>\r
  31 </html>\r