LayoutTests/fast/dom/node-iterator-document-moved-crash.html - WebKit - Git at Google

 <html>
     <head>
         <script>
             if (window.testRunner) {
                 testRunner.dumpAsText();
                 testRunner.waitUntilDone();
             }

             function gc()
             {
                 if (window.GCController)
                     return GCController.collect();

                 for (var i = 0; i < 10000; i++) { // force garbage collection (FF requires about 9K allocations before a collect).
                     var s = new String("abc");
                 }
             }

             function runTest()
             {
                 aElement = document.createElement('a');
                 divElement = document.createElement('div');
                 document.body.appendChild(divElement);
                 nodeIterator = win.document.createNodeIterator(aElement);
                 win.document.body.appendChild(aElement);

                 delete nodeIterator;
                 gc();
                 document.body.removeChild(divElement);
                 gc();

                 if (window.testRunner)
                     testRunner.notifyDone();
             }
         </script>
     </head>
     <body>
         <iframe onload="this.onload = null; win = this.contentWindow; runTest();"></iframe>
         Test passes if it does not crash.
     </body>
 </html>
	<html>
	<head>
	<script>
	if (window.testRunner) {
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	}

	function gc()
	{
	if (window.GCController)
	return GCController.collect();

	for (var i = 0; i < 10000; i++) { // force garbage collection (FF requires about 9K allocations before a collect).
	var s = new String("abc");
	}
	}

	function runTest()
	{
	aElement = document.createElement('a');
	divElement = document.createElement('div');
	document.body.appendChild(divElement);
	nodeIterator = win.document.createNodeIterator(aElement);
	win.document.body.appendChild(aElement);

	delete nodeIterator;
	gc();
	document.body.removeChild(divElement);
	gc();

	if (window.testRunner)
	testRunner.notifyDone();
	}
	</script>
	</head>
	<body>
	<iframe onload="this.onload = null; win = this.contentWindow; runTest();"></iframe>
	Test passes if it does not crash.
	</body>
	</html>