chromium/third_party/blink/web_tests/virtual/text-antialias/split-text-crash.xhtml

<html xmlns="http://www.w3.org/1999/xhtml">
<body></body>
<script>

// TODO(crbug.com/1446498) This test can be deleted once Mutation Events are removed.

if (window.testRunner) {
    testRunner.waitUntilDone();
    testRunner.dumpAsText();
}

function crash() {
    document.designMode = "on";
    var textNode = document.body.appendChild(document.createTextNode("PASS. WebKit didn't crash."));
    var range = document.createRange();
    range.setStart(textNode, 0);
    document.addEventListener("DOMNodeInserted", function () {
        if (textNode)
            document.body.removeChild(textNode);
        textNode = null;

        if (window.testRunner) {
            GCController.collect();
            setTimeout("testRunner.notifyDone()", 0);
        }
    }, true);
    try {
        range.insertNode(document.createTextNode(""));
    } catch(e) { }
}

window.onload = crash;
</script>
</html>