LayoutTests/fast/innerHTML/innerHTML-script-tag-crash.xhtml - WebKit - Git at Google

 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
     <script>
         <![CDATA[
             if (window.layoutTestController)
                 layoutTestController.dumpAsText();

             var span = document.createElement("span");
             document.documentElement.appendChild(span);
             span.outerHTML = "<sc"+"ript></scr"+"ipt>";
         ]]>
     </script>
 </head>
 <body>
     <p>This tests a crash in the xml parser when using innerHTML or outerHTML to insert a script tag into a xhtml
        document. (rdar://problem/5519698).  The test has passed if it does not crash.</p>
 </body>
 </html>
	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
	<html xmlns="http://www.w3.org/1999/xhtml">
	<head>
	<script>
	<![CDATA[
	if (window.layoutTestController)
	layoutTestController.dumpAsText();

	var span = document.createElement("span");
	document.documentElement.appendChild(span);
	span.outerHTML = "<sc"+"ript></scr"+"ipt>";
	]]>
	</script>
	</head>
	<body>
	<p>This tests a crash in the xml parser when using innerHTML or outerHTML to insert a script tag into a xhtml
	document. (rdar://problem/5519698). The test has passed if it does not crash.</p>
	</body>
	</html>