LayoutTests/fast/parser/nested-fragment-parser-crash.html

x<h4><strike>x
This test passes if it doesn't crash.
<script>
  if (window.testRunner)
    testRunner.dumpAsText();

  var counter = 0;
  window.onload=function(){
    document.execCommand("SelectAll");
    document.designMode="on";
    document.execCommand("Indent");
    document.execCommand("InsertOrderedList", false);
  };
  function handler() {
    // This constant is somewhat magic. It's the smallest constant such that
    // we'll exceed the maxium call stack size.
    if (++counter >= 34)
      document.removeEventListener("DOMSubtreeModified", handler, false);
    document.execCommand("outdent", false);
  };
  document.addEventListener("DOMSubtreeModified", handler, false);
</script>