body-inserting-iframe-crash.html | Explore in Territory

<!DOCTYPE html>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var iframe = null;

function start() {
    iframe = document.createElement('iframe');
    iframe.setAttribute('marginwidth', 1);
    document.body.appendChild(iframe);

    var bodyInFrame = document.createElement('body');
    bodyInFrame.addEventListener('DOMSubtreeModified', removeIframe);
    iframe.contentDocument.documentElement.appendChild(bodyInFrame);
    document.body.innerHTML = 'PASS if not crashed.';
}

function removeIframe() {
    iframe.parentNode.removeChild(iframe);
    iframe = null;
    gc();
}
</script>
<body onload="start()">
</body>

chromium/third_party/blink/web_tests/dom/mutation-event-tests/html/sections/body-inserting-iframe-crash.html