LayoutTests/fast/dom/insertBefore-refChild-crash.html

<div>Test passes if it does not crash.</div>
<span id=container><span></span></span>
<span id=newChild></span>
<script src="../../resources/gc.js"></script>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var container = document.getElementById('container');
var newChild = document.getElementById('newChild');
function handleNodeRemoved() {
    newChild.removeEventListener('DOMNodeRemoved', handleNodeRemoved);
    container.innerHTML = '';
    gc();
}
newChild.addEventListener('DOMNodeRemoved', handleNodeRemoved, false);
var range = document.createRange();
range.selectNodeContents(container);
range.insertNode(newChild);
</script>