chromium/third_party/blink/web_tests/traversal/size-zero-run.html

<html>

<head>
<script>
function test() {
    if (window.testRunner) {
        testRunner.dumpAsText();
    }

    var textnode1 = document.getElementById("node").firstChild;
    var textnode2 = textnode1.splitText(3);
    textnode2.nodeValue = "";

    var root = document.body;
    var it = document.createNodeIterator(root, NodeFilter.SHOW_ELEMENT, null);

    var n = it.nextNode();
    while(n) {
        n = it.nextNode();
    }

    var text = document.getElementById("node").innerText;
}
</script>
</head>

<body onload="test();">
<p>If a zero-length render object (such as a text node that has been set
to "") occurred at the end of a line, it was previously given a non-zero
sized run.</p>
<p>A crash would occur on iteration over a node containing such a run.
NodeIterators, the innerText property, and hovering over a link all
use iteration.</p>
<p>This tests iteration using both the innerText property and
NodeIterators.  It is successful if it doesn't crash Safari.</p>
<hr>
<a href="#" id="node">hello</a></body></html>