LayoutTests/scrollbars/scrollbar-owning-renderer-crash.html - WebKit - Git at Google

 <html id="html1">
 <head id="head1">
 <style>
 ::-webkit-scrollbar { height: 50000; }
  </style>
 <script>
 if (window.testRunner) {
     testRunner.dumpAsText();
     testRunner.waitUntilDone();
 }

 function runTest() {
     child = document.getElementById('head1');
     child.parentNode.removeChild(child);
     document.body.offsetTop;
     child = document.getElementById('html1');
     child.parentNode.removeChild(child);
     document.open();
     document.write("WebKit bug 80610 - Crash due to owning renderer not removed from custom scrollbar. <br />");
     document.write("PASS. WebKit didn't crash.");
     document.close();
 }

 function finish() {
     if (window.eventSender)
         eventSender.mouseMoveTo(100, 100);
     if (window.testRunner)
         testRunner.notifyDone();
 }

 setTimeout("if (window.eventSender) eventSender.mouseMoveTo(0, 0);", 0);
 setTimeout("runTest();", 10);
 setTimeout("finish();", 11);
 </script>
 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
 </head>
 </html>
	<html id="html1">
	<head id="head1">
	<style>
	::-webkit-scrollbar { height: 50000; }
	</style>
	<script>
	if (window.testRunner) {
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	}

	function runTest() {
	child = document.getElementById('head1');
	child.parentNode.removeChild(child);
	document.body.offsetTop;
	child = document.getElementById('html1');
	child.parentNode.removeChild(child);
	document.open();
	document.write("WebKit bug 80610 - Crash due to owning renderer not removed from custom scrollbar. <br />");
	document.write("PASS. WebKit didn't crash.");
	document.close();
	}

	function finish() {
	if (window.eventSender)
	eventSender.mouseMoveTo(100, 100);
	if (window.testRunner)
	testRunner.notifyDone();
	}

	setTimeout("if (window.eventSender) eventSender.mouseMoveTo(0, 0);", 0);
	setTimeout("runTest();", 10);
	setTimeout("finish();", 11);
	</script>
	0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
	</head>
	</html>