option-text-mutation-crash.html | Explore in Territory

<!DOCTYPE html>
<html>
<script>
var count = 0;
if (!window.testRunner)
    document.write("This test requires GCController.");
else {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();

    function crash() {
        if (++count > 1)
            return;
        document.open();
        document.write('PASS');
        document.close();
        GCController.collect();
        setTimeout("testRunner.notifyDone()", 0);
    }

    setTimeout(function () {
        document.write("<select><option>First Child</option></select>");
        document.getElementsByTagName('option')[0].appendChild(document.createTextNode("Second Child"));

        document.addEventListener('DOMNodeRemovedFromDocument', function () { crash(); }, true);
        document.getElementsByTagName('option')[0].text = "New text";
    }, 0);
}
</script>
</html>

chromium/third_party/blink/web_tests/dom/mutation-event-tests/fast/dom/option-text-mutation-crash.html