LayoutTests/fast/table/table-insert-object-before-td-crash.html - WebKit - Git at Google

 <doctype HTML>
 <html>
 <body>
 Test that node insertion of an object before a &lt;td&gt; works properly.
 This test passes if it does not crash.
 <table>
     <td id="td">X</td>
 </table>
 <div id="result"><span style='color: red;'>FAIL:</span> Did not complete test</div>
 <script>
 if (window.testRunner) {
     testRunner.dumpAsText();
 }

 var new_elem = document.createElement("col");
 var td = document.getElementById("td");
 td.parentNode.insertBefore(new_elem, td.nextSibling);
 new_elem = document.createElement("object");
 new_elem.setAttribute('standby', 'X');
 td.parentNode.insertBefore(new_elem, td.nextSibling);

 document.getElementById("result").innerHTML = "<span style='color: green;'>PASS:</span> Did not crash.";
 </script>
 </body>
 </html>
	<doctype HTML>
	<html>
	<body>
	Test that node insertion of an object before a <td> works properly.
	This test passes if it does not crash.
	<table>
	<td id="td">X</td>
	</table>
	<div id="result"><span style='color: red;'>FAIL:</span> Did not complete test</div>
	<script>
	if (window.testRunner) {
	testRunner.dumpAsText();
	}

	var new_elem = document.createElement("col");
	var td = document.getElementById("td");
	td.parentNode.insertBefore(new_elem, td.nextSibling);
	new_elem = document.createElement("object");
	new_elem.setAttribute('standby', 'X');
	td.parentNode.insertBefore(new_elem, td.nextSibling);

	document.getElementById("result").innerHTML = "<span style='color: green;'>PASS:</span> Did not crash.";
	</script>
	</body>
	</html>