remove-body-during-title-creation.html

<!DOCTYPE html>
<html>
<body><div><script>

if (!window.testRunner)
    document.write("This test requires GCController.");
else {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();

    function crash() {
        if (document.lastChild.firstChild.firstChild.firstChild) {
            document.lastChild.removeChild(document.lastChild.firstChild);
            GCController.collect();
            setTimeout(function () {
                document.body.innerHTML = "PASS. WebKit (or Blink) didn't crash."
                testRunner.notifyDone();
            }, 0);
        }
        GCController.collect();
    }

    setTimeout(function () {
        document.addEventListener('DOMNodeInsertedIntoDocument', function () { crash(); }, true);
        document.addEventListener('DOMSubtreeModified', function () { /* noop */ }, false);
        document.title = 'hello';
    }, 0);
}

</script>
</body>
</html>

chromium/third_party/blink/web_tests/dom/mutation-event-tests/html/sections/remove-body-during-title-creation.html