chromium/third_party/blink/web_tests/dom/attr/update-attribute-node-no-crash.html

<!DOCTYPE HTML>
<html>
<head>
<title>Updating value of replaced attribute node</title>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
</head>
<body>
<iframe></iframe>
<div id="test" style="background-color: red"></div>
<script>
setup({single_test: true});
var element = document.getElementById("test");
var attr = document.createAttribute("STYLE");
// This aligns with Trident rather than Gecko.
replaced = element.setAttributeNode(attr);
assert_equals(replaced.name, "style");
assert_equals(replaced.value, "background-color: red");
assert_equals(attr.name, "style");
assert_equals(attr.value, "");
assert_equals(element.getAttribute('style'), "");
assert_equals(element.getAttribute('StyLE'), "");
// Setting the value must correctly locate attribute on the element and update it,
// even if the local name differs. PASS if no crash (crbug.com/376718)
attr.value = 'background-color: green';
assert_equals(attr.value, "background-color: green");
assert_equals(element.getAttribute('stylE'), "background-color: green");
done();
</script>
</body>
</html>