chromium/third_party/blink/web_tests/fast/dom/NodeList/5725058-crash-scenario-1.html

<p>Test for (rdar://problem/5725058). If you see this text, then all is well and no crash has occurred.</p>

<span>
    <div name='test'></div>
</span>
<script type='text/javascript'>
    if (window.testRunner)
        testRunner.dumpAsText();

    function triggerGarbageCollection()
    {
        if (window.GCController) {
            GCController.collect();
            return;
        }
        for (var i = 0; i < 10000; ++i)
            ({})
    }

    document.getElementsByName('test')[0];
    triggerGarbageCollection();
    document.getElementsByTagName('span')[0].innerHTML = '';
    triggerGarbageCollection();
    document.getElementsByName('test')[0];
</script>