<!DOCTYPE html>
<html>
<head>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}
</script>
<style>
.class1 { -webkit-mask-box-image-source: url(#nonexistentURL); }
</style>
<script>
function freememory() {
    var a;
    for(var i=0;i<100;i++) {
        a = new Uint8Array(1024*1024);
    }
    document.implementation.createHTMLDocument("doc");
}

function createTestRange() {
    var testRange = document.createRange();
    testRange.setEndAfter(testSelectOption);
    testRange.deleteContents();
}

function eventhandler1() {
    var testDataList = document.createElement("datalist");
    testSelect.appendChild(testObjectParam);
    document.title = "foo";
    testDataList.addEventListener("DOMNodeInsertedIntoDocument", createTestRange);
    testObject.appendChild(testDataList);
    freememory();
}

function eventhandler2() {
    testObject.setAttribute("onbeforeload", "eventhandler1()");
    testSelect.addEventListener("DOMNodeRemovedFromDocument", eventhandler1);
    testSelect.replaceWith("This test passes if there is no exception.");
}

function runTest() {
    var testSource = document.createElement("source");
    testSource.addEventListener("DOMSubtreeModified", eventhandler2);
    testSource.setAttribute("onsubmit", "");
    if (window.testRunner)
        testRunner.notifyDone();
}
</script>
</head>
<body onload=runTest()>
    <li class="class1">Test List</li>
    <object id="testObject">
        <param id="testObjectParam"></param>
    </object>
    <select id="testSelect">
        <option id="testSelectOption">Test Option</option>
    </select>
</body>
</html>