tests/tests/webkitsecurity/assets/doctype-event-listener-crash.html

<p>This page tests for a crash when adding an event listener to a doctype node.</p>
<p>If the test passes, you'll see a PASS message below.</p>

<pre>PASS: You didn't crash.</pre>

<script>
if (window.layoutTestController)
    layoutTestController.dumpAsText();
var doctype = document.implementation.createDocumentType("html", 0, 0);
doctype.addEventListener("click", function () { }, false);
</script>