LayoutTests/fast/forms/button-set-text-crash.html - WebKit - Git at Google

 <!DOCTYPE html>
 <html>
 <body>
 PASS if no crash.
 <input id=foobar type="button"></input>
 <script>
 if (window.testRunner)
     testRunner.dumpAsText();
 document.body.offsetHeight;
 foobar.value = "foobar";
 </script>
 </body>
 </html>
	<!DOCTYPE html>
	<html>
	<body>
	PASS if no crash.
	<input id=foobar type="button"></input>
	<script>
	if (window.testRunner)
	testRunner.dumpAsText();
	document.body.offsetHeight;
	foobar.value = "foobar";
	</script>
	</body>
	</html>