chromium/third_party/blink/web_tests/fast/tokenizer/flush-characters-in-document-write-evil.html

<head>
<script>
if (window.testRunner) {
  testRunner.dumpAsText();
  testRunner.waitUntilDone();
}

function test() {
  document.write("<div>Should be 12:</div><div>1");

  if (document.getElementsByTagName("div").length != 2)
    alert("Error - wrong number of DIVs at step 1");

  if (document.getElementsByTagName("div")[1].textContent != "1")
    alert("Error - incorrect div content at step 1");

  setTimeout(test2, 10);
}

function test2() {
  document.write("2</div>")

  if (document.getElementsByTagName("div").length != 2)
    alert("Error - wrong number of DIVs at step 2");

  if (document.getElementsByTagName("div")[1].textContent != "12")
    alert("Error - incorrect div content at step 2");

  document.close();

  setTimeout("testRunner.notifyDone()", 10);
}
</script>
</head>
<body onload="test()">
</body>