Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/dom/mutation-event-tests/fast/dom/Range/range-insertNode-assertion.html 

<!DOCTYPE html>
<body>
<script src="../../../../../resources/js-test.js"></script>
<div id="parent1">text</div>
<div id="parent2">text</div>
<script>
function handleInsertion() {
    document.removeEventListener('DOMNodeInserted', handleInsertion);
    parent.innerHTML = '';
}
document.addEventListener('DOMNodeInserted', handleInsertion);
var parent = document.getElementById('parent1');
var r = new Range();
window.getSelection().addRange(r);
r.setStart(parent, 0);
r.setEnd(parent, 0);
r.insertNode(document.createElement('span'));
parent.remove();

function handleInsertion2() {
    if (parent.childNodes.length != 3)
        return;
    var textNodeCreatedBySplitText = parent.lastChild;
    parent.removeChild(textNodeCreatedBySplitText);
    document.removeEventListener('DOMNodeInserted', handleInsertion2);
}
document.addEventListener('DOMNodeInserted', handleInsertion2);
parent = document.getElementById('parent2');
r.setStart(parent2.firstChild, 2);
r.setEnd(parent2.firstChild, 2);
r.insertNode(document.createElement('span'));

description('No assertion failures even if a DOM mutation event handler updates nodes in a Range during Range::insertNode.');
testPassed('if this did not crash.');
parent.remove();
</script>
</body>