1 files changed, 42 insertions, 0 deletions
diff --git a/LayoutTests/fast/dom/NodeList/5725058-crash-scenario-2.html b/LayoutTests/fast/dom/NodeList/5725058-crash-scenario-2.html
new file mode 100644
index 0000000..147b2df
--- /dev/null
+++ b/LayoutTests/fast/dom/NodeList/5725058-crash-scenario-2.html
@@ -0,0 +1,42 @@
+<p>Test for (rdar://problem/5725058). If you see this text, then all is well and no crash has occurred.</p>
+
+<p id="a">paragraph a</p>
+<p id="b">paragraph b</p>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function triggerGarbageCollection()
+{
+    if (window.GCController) {
+        GCController.collect();
+        return;
+    }
+    for (var i = 0; i < 10000; ++i)
+        ({})
+}
+
+function setUp()
+{
+    // This only works if in a function. I'm not sure why.
+
+    // Get node and length from paragraph A into the cache.
+    document.getElementById("a").childNodes[0];
+    document.getElementById("a").childNodes.length;
+}
+
+setUp();
+
+// Get back to "zero node lists".
+triggerGarbageCollection();
+
+// Remove the child node of paragraph A. Use innerHTML to avoid getting a reference to the node being removed.
+document.getElementById("a").innerHTML = "";
+
+// Get back to "one node list".
+var childNodesB = document.getElementById("b").childNodes;
+
+// Now try the original list.
+var x = document.getElementById("a").childNodes[0];
+x = document.getElementById("a").childNodes.length;
+</script>