LayoutTests/fast/block/merge-anonymous-block-remove-child-crash.html - WebKit - Git at Google

 <html>
 <body onload="runTest();">
 <span style="display: run-in" id="runIn">
 </span>
 <span style="display: list-item" id="listItem">
 </span>
 <div id="result"></div>
 <script>
 if (window.testRunner)
 {
     testRunner.dumpAsText();
     testRunner.waitUntilDone();
 }

 function runTest()
 {
     document.body.offsetTop;
     var runIn = document.getElementById('runIn');
     var listItem = document.getElementById('listItem');

     runIn.appendChild(document.createElement('menu'));

     ol = document.createElement('ol');
     listItem.appendChild(ol);
     listItem.appendChild(document.createElement('i'));

     document.body.offsetTop;
     listItem.removeChild(ol);
     document.body.removeChild(runIn);
     document.body.removeChild(listItem);

     document.getElementById('result').innerHTML = "PASS";
     if (window.testRunner)
         testRunner.notifyDone();
 }
 </script>
 </body>
 </html>
	<html>
	<body onload="runTest();">
	<span style="display: run-in" id="runIn">
	</span>
	<span style="display: list-item" id="listItem">
	</span>
	<div id="result"></div>
	<script>
	if (window.testRunner)
	{
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	}

	function runTest()
	{
	document.body.offsetTop;
	var runIn = document.getElementById('runIn');
	var listItem = document.getElementById('listItem');

	runIn.appendChild(document.createElement('menu'));

	ol = document.createElement('ol');
	listItem.appendChild(ol);
	listItem.appendChild(document.createElement('i'));

	document.body.offsetTop;
	listItem.removeChild(ol);
	document.body.removeChild(runIn);
	document.body.removeChild(listItem);

	document.getElementById('result').innerHTML = "PASS";
	if (window.testRunner)
	testRunner.notifyDone();
	}
	</script>
	</body>
	</html>