LayoutTests/imported/blink/fast/html/insert-selected-option-crash.html - WebKit - Git at Google

 <!DOCTYPE html>
 <p>You should see the word PASS below, and no crash.</p>
 <p id="p">FAIL</p>
 <script>
     p.offsetTop;
     p.innerHTML = "&nbsp;<form><select multiple><option selected></option></select><input max=1 min=1 type=number></form>";
     p.innerHTML = "PASS";
 </script>
	<!DOCTYPE html>
	<p>You should see the word PASS below, and no crash.</p>
	<p id="p">FAIL</p>
	<script>
	p.offsetTop;
	p.innerHTML = " <form><select multiple><option selected></option></select><input max=1 min=1 type=number></form>";
	p.innerHTML = "PASS";
	</script>