LayoutTests/fast/forms/select-set-inner.html

<html>

<head>

<script>

function test()
{
    if (window.testRunner)
        testRunner.dumpAsText();

    document.getElementById('select').length; // cause the <select> element to build a list of options
    document.getElementById('group').innerHTML = ""; // remove an option using innerHTML
    document.getElementById('select').length; // cause the <select> element to use the list of options
    document.getElementById('select').innerHTML = ""; // remove the other option using innerHTML
    document.getElementById('select').length; // cause the <select> element to use the list of options

    document.getElementById('result').innerHTML = "PASSED";
}

</script>

</head>

</html>

<body onload="test()">

<p>This tests a case where removing an option element from a select by using innerHTML would cause a crash.</p>

<p id="result">TEST NOT RUN</p>

<select id="select">
   <option>here is one</option>
   <optgroup id="group" label="group"><option>here is another</option></optgroup>
</select>

</body>

</html>