LayoutTests/fast/tokenizer/flush-characters-in-document-write-evil.html - WebKit - Git at Google

 <head>
 <script>
 if (window.testRunner) {
   testRunner.dumpAsText();
   testRunner.waitUntilDone();
 }

 function test() {
   document.write("<div>Should be 12:</div><div>1");

   if (document.getElementsByTagName("div").length != 2)
     alert("Error - wrong number of DIVs at step 1");

   if (document.getElementsByTagName("div")[1].textContent != "1")
     alert("Error - incorrect div content at step 1");

   setTimeout(test2, 10);
 }

 function test2() {
   document.write("2</div>")

   if (document.getElementsByTagName("div").length != 2)
     alert("Error - wrong number of DIVs at step 2");

   if (document.getElementsByTagName("div")[1].textContent != "12")
     alert("Error - incorrect div content at step 2");

   document.close();

   setTimeout("testRunner.notifyDone()", 10);
 }
 </script>
 </head>
 <body onload="test()">
 </body>
	<head>
	<script>
	if (window.testRunner) {
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	}

	function test() {
	document.write("<div>Should be 12:</div><div>1");

	if (document.getElementsByTagName("div").length != 2)
	alert("Error - wrong number of DIVs at step 1");

	if (document.getElementsByTagName("div")[1].textContent != "1")
	alert("Error - incorrect div content at step 1");

	setTimeout(test2, 10);
	}

	function test2() {
	document.write("2</div>")

	if (document.getElementsByTagName("div").length != 2)
	alert("Error - wrong number of DIVs at step 2");

	if (document.getElementsByTagName("div")[1].textContent != "12")
	alert("Error - incorrect div content at step 2");

	document.close();

	setTimeout("testRunner.notifyDone()", 10);
	}
	</script>
	</head>
	<body onload="test()">
	</body>