insertedIntoDocument-no-crash.html | Explore in Territory

<html>
<p>This test must not crash.</p>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function f1() {
    document.write('<form>'); //Here we need the form tag to trigger the bug
    document.getElementsByTagName("s")[0].innerHTML = 'foo';
}

function f2() {
    try {
        document.getElementsByTagName("kbd")[0].innerHTML = 'foo';
        document.getElementsByTagName("kbd")[0].insertBefore(document.createElement('foo'),document.createElement('foo'));
    } catch (e) {
        // We are not interested in exceptions.
    }
}
</script>
<s>
<!-- The following weird mark-up is needed to reproduce the crash -->
<script>f1();</script>
<xmp><mark>
<script>f1();</script>
<xmp></xmp>
<kbd>
<script>f2();</script>
</kbd>
</s>
</html>

chromium/third_party/blink/web_tests/fast/dom/insertedIntoDocument-no-crash.html