chromium/src/third_party/blink/web_tests/fast/dom/NodeList/5725058-crash-scenario-3.html

<p>Test for (rdar://problem/5725058). If you see this text, then all is well and no crash has occurred.</p>

<p id="a"><a name="anchor">paragraph a</a></p>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var list = document.getElementsByName("anchor");
var x = list.length
x = list[0];

// Remove the child node of paragraph A. Use innerHTML to avoid getting a reference to the node being removed.
document.getElementById("a").innerHTML = "";

// Now try the original list.
x = list.length;
x = list[0];
</script>