xhtml-with-titleElement-parsing-crash.xhtml

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script>
if (window.testRunner)
    testRunner.dumpAsText();
</script>
</head>
<body>
  <p>[bug 112328] <a href="https://bugs.webkit.org/show_bug.cgi?id=112328">https://bugs.webkit.org/show_bug.cgi?id=112328</a> This test ensures WebKit does not crash when parsing XHTML which has a title element as a descendant node of a template element. If there is no crash, the test passes.</p>
  <template>
    <object>
      <title>replaceWholeText sample</title>
    </object>
  </template>
  <div>PASS</div>
</body>
</html>

chromium/third_party/blink/web_tests/fast/dom/HTMLTemplateElement/xhtml-with-titleElement-parsing-crash.xhtml