ManualTests/chromium/onchange-reload-popup.html - WebKit - Git at Google

 <html>
 <head>
     <script type="text/javascript">

     function addEvent(obj, evType, fn) {
         if (obj.addEventListener){
           obj.addEventListener(evType, fn, false);
           return true;
         } else if (obj.attachEvent){
           var r = obj.attachEvent("on"+evType, fn);
           return r;
         } else {
           return false;
         }
     }

     function reloadSelect() {
         var container = document.getElementById('container');
         container.innerHTML = '<select id="menu"> \
           <option value="abcd">abcd</option>\
           <option value="defg">efgh</option>\
         </select>';

         var menu = document.getElementById('menu');
         addEvent(menu, 'change', reloadSelect);
     }

     </script>
 </head>
 <body>
     <p>Do the following and see if Chromium crashes.</p>
     <ul>
       <li>Click the select</li>
       <li>Press 'e' on your keyboard</li>
       <li>Click on the document but not the select itself.</li>
     </ul>

     <div id="container"/>
     <script>
         reloadSelect()
     </script>
     </div>
 </body>
 </html>
	<html>
	<head>
	<script type="text/javascript">

	function addEvent(obj, evType, fn) {
	if (obj.addEventListener){
	obj.addEventListener(evType, fn, false);
	return true;
	} else if (obj.attachEvent){
	var r = obj.attachEvent("on"+evType, fn);
	return r;
	} else {
	return false;
	}
	}

	function reloadSelect() {
	var container = document.getElementById('container');
	container.innerHTML = '<select id="menu"> \
	<option value="abcd">abcd</option>\
	<option value="defg">efgh</option>\
	</select>';

	var menu = document.getElementById('menu');
	addEvent(menu, 'change', reloadSelect);
	}

	</script>
	</head>
	<body>
	<p>Do the following and see if Chromium crashes.</p>
	<ul>
	<li>Click the select</li>
	<li>Press 'e' on your keyboard</li>
	<li>Click on the document but not the select itself.</li>
	</ul>

	<div id="container"/>
	<script>
	reloadSelect()
	</script>
	</div>
	</body>
	</html>