Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/dom/mutation-event-tests/fast/dom/insertBefore-refChild-crash.html 

<!DOCTYPE html>
<div>Test passes if it does not crash.</div>
<span id=container><span></span></span>
<span id=newChild></span>
<script src="../../../../resources/gc.js"></script>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var container = document.getElementById('container');
var newChild = document.getElementById('newChild');
function handleNodeRemoved() {
    newChild.removeEventListener('DOMNodeRemoved', handleNodeRemoved);
    container.innerHTML = '';
    gc();
}
newChild.addEventListener('DOMNodeRemoved', handleNodeRemoved, false);
var range = document.createRange();
range.selectNodeContents(container);
range.insertNode(newChild);
</script>