append_child_recurse_crash.html | Explore in Territory

<!DOCTYPE>
<body>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<div>
<p id="parent">bar</p>
<span id="test-title">title</span>
</div>
<script>
test(() => {
  var parent = document.querySelector('#parent');
  var test_title = document.querySelector('#test-title');

  // This function is called recursively.
  function tCF_custom_1() {
    var doc = document.implementation.createDocument('http://www.w3.org/1999/xhtml', 'html');
    doc.adoptNode(parent);
    parent.appendChild(test_title);
  }
  parent.addEventListener('DOMSubtreeModified', tCF_custom_1, false);

  parent.appendChild(test_title);
}, 'Adopting parent node in DOMSubtreeModified event handler should not cause a crash.');
</script>
</body>

chromium/third_party/blink/web_tests/dom/node/append_child_recurse_crash.html