LayoutTests/fast/tokenizer/write-unclosed-script.html - WebKit - Git at Google

 <html>
 <head>
     <script type="text/javascript">
     if (window.testRunner)
         testRunner.dumpAsText();

         var str = "";

         function writeResult()
         {
             var res = document.getElementById("result");
             if (str == "foobar")
                 res.innerText = "PASS";
             else
                 res.innerText = "FAIL ("+str+")";
         }
     </script>
 </head>
 <body onload="writeResult();">
     <script type="text/javascript">
         <!--
         document.write('<script type="text/javascript">');
         document.write('str += "foo"');
         //-->
     </script>
         str += "bar";
     </script>
     <p>
         This is a test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=9317">https://bugs.webkit.org/show_bug.cgi?id=9317</a>
         REGRESSION: crash in HTML tokenizer at Japanese Apple support page</i>.
     </p>
     <hr>
     <p>
         Test result: <span id="result">FAIL (did not complete)</span>
     </p>
 </body>
 </html>
	<html>
	<head>
	<script type="text/javascript">
	if (window.testRunner)
	testRunner.dumpAsText();

	var str = "";

	function writeResult()
	{
	var res = document.getElementById("result");
	if (str == "foobar")
	res.innerText = "PASS";
	else
	res.innerText = "FAIL ("+str+")";
	}
	</script>
	</head>
	<body onload="writeResult();">
	<script type="text/javascript">
	<!--
	document.write('<script type="text/javascript">');
	document.write('str += "foo"');
	//-->
	</script>
	str += "bar";
	</script>
	<p>
	This is a test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=9317">https://bugs.webkit.org/show_bug.cgi?id=9317</a>
	REGRESSION: crash in HTML tokenizer at Japanese Apple support page</i>.
	</p>
	<hr>
	<p>
	Test result: <span id="result">FAIL (did not complete)</span>
	</p>
	</body>
	</html>