change-form-element-document-crash.html

<html>
<head>
<script src="../../resources/gc.js"></script>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function crash_test(element_name) {
    var element = document.createElement(element_name);
    element.setAttribute('form', '1');
    var container = document.createElement('div');
    container.appendChild(element);
    document.implementation.createDocument(null, '').adoptNode(container);
    container.removeChild(element);
    delete element;
    gc();
    var form = document.createElement('form');
    form.setAttribute('id', '2');
    document.body.appendChild(form)
}

function test() {
    crash_test('input');
    crash_test('object');
    document.body.innerHTML += "PASS";
}
</script>
</head>
<body onload="test()">
<p>
This page is a test case for <a href="https://bugs.webkit.org/show_bug.cgi?id=51418">Bug 51418</a>. WebKit should not crash when this page is loaded.
</p>
</body>
</html>

chromium/third_party/blink/web_tests/fast/forms/change-form-element-document-crash.html