chromium/src/third_party/blink/web_tests/fast/dom/MutationObserver/mutation-callback-non-element-crash.html - manifest_repos/chromium_src - Git at Google

 <!DOCTYPE html>
 <html>
 <body>
 <script>
 if (window.testRunner)
     testRunner.dumpAsText();

 function mutationCallback(mutations, observer) {
     mutations[0].addedNodes[-1];
 }

 var mutationObserver = new MutationObserver(mutationCallback);
 mutationObserver.observe(document.body, {childList: true});
 document.body.appendChild(document.createTextNode("PASS. WebKit didn't crash"));
 </script>
 </body>
 </html>
	<!DOCTYPE html>
	<html>
	<body>
	<script>
	if (window.testRunner)
	testRunner.dumpAsText();

	function mutationCallback(mutations, observer) {
	mutations[0].addedNodes[-1];
	}

	var mutationObserver = new MutationObserver(mutationCallback);
	mutationObserver.observe(document.body, {childList: true});
	document.body.appendChild(document.createTextNode("PASS. WebKit didn't crash"));
	</script>
	</body>
	</html>