chromium/src/third_party/blink/web_tests/fast/dom/NodeList/5725058-crash-scenario-2.html

<p>Test for (rdar://problem/5725058). If you see this text, then all is well and no crash has occurred.</p>

<p id="a">paragraph a</p>
<p id="b">paragraph b</p>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function triggerGarbageCollection()
{
    if (window.GCController) {
        GCController.collect();
        return;
    }
    for (var i = 0; i < 10000; ++i)
        ({})
}

function setUp()
{
    // This only works if in a function. I'm not sure why.

    // Get node and length from paragraph A into the cache.
    document.getElementById("a").childNodes[0];
    document.getElementById("a").childNodes.length;
}

setUp();

// Get back to "zero node lists".
triggerGarbageCollection();

// Remove the child node of paragraph A. Use innerHTML to avoid getting a reference to the node being removed.
document.getElementById("a").innerHTML = "";

// Get back to "one node list".
var childNodesB = document.getElementById("b").childNodes;

// Now try the original list.
var x = document.getElementById("a").childNodes[0];
x = document.getElementById("a").childNodes.length;
</script>