button-inner-child-crash.html | Explore in Territory

<!DOCTYPE html>
<style>
html, body, button { all: inherit; }
.resizer::-webkit-resizer { text-anchor: end; }
.resize { resize: horizontal; }
</style>

<script>
if (window.testRunner)
  testRunner.dumpAsText();

function crash() {
  outer_button.addEventListener("DOMNodeRemoved", function () {
    outer_button.removeAttribute("class");
  }, false);

  outer_button.appendChild(inner_button);
  outer_button.classList.toggle("resizer");
  outer_button.classList.add("resize");

  window.scrollBy(54, 49);
  inner_button.style.display = "table-row-group"

  var svg = document.implementation.createDocument("http://www.w3.org/2000/svg", "svg", null);
  svg.documentElement.appendChild(input);

  window.scrollBy(11, 81);

  inner_button.parentNode.removeChild(inner_button);
}
document.addEventListener("DOMContentLoaded", crash, false);
</script>

<button id='outer_button'>
  Test passes if it does not crash.
  <input id='input'>
    <button id='inner_button'></button>
  </input>
</button>

chromium/third_party/blink/web_tests/dom/mutation-event-tests/fast/css/button-inner-child-crash.html