chromium/third_party/blink/web_tests/fast/dom/null-chardata-crash.html

<html>
<body>
  <p>To pass, this test should not crash</p>
  <script>
    if (window.testRunner)
      testRunner.dumpAsText();

    var o = document.createTextNode('');
    try {
      o.data = null;
      o.splitText(1);
    } catch (e) {}
  </script>
</body>
</html>