chromium/third_party/blink/web_tests/fast/dom/Range-insertNode-crash.html

<!DOCTYPE html>
<html>
<head>
    <script type="text/javascript">
        function log(msg)
        {
            document.getElementById('console').appendChild(document.createTextNode(msg + '\n'));
        }

        function runTests()
        {
            if (window.testRunner)
                testRunner.dumpAsText();

            var r = document.createRange();
            try {
                r.insertNode(r);
            } catch(e) {
            }

            log('PASS: No crash.');
        }
    </script>
</head>
<body onload="runTests();">
    <p>This tests that we don't crash when passing null to Range.insertNode().  (rdar://problem/5488478)</p>
    <pre id="console"></pre>
</body>
</html>