LayoutTests/fast/forms/4628409.html

<p>This tests for a crash when inserting text into a textarea that has been shrunk to zero rows just before the insertion.</p>
<textarea id="textarea" rows="1"></textarea>
<script>
if (window.testRunner)
    window.testRunner.dumpAsText();
var e = document.getElementById("textarea");
e.setSelectionRange(0, 0);
e.rows = 0;
document.execCommand("InsertText", false, "x");
</script>