<!DOCTYPE html>
<style>
html, body, button { all: inherit; }
.resizer::-webkit-resizer { text-anchor: end; }
.resize { resize: horizontal; }
</style>
<script>
if (window.testRunner)
testRunner.dumpAsText();
function crash() {
outer_button.addEventListener("DOMNodeRemoved", function () {
outer_button.removeAttribute("class");
}, false);
outer_button.appendChild(inner_button);
outer_button.classList.toggle("resizer");
outer_button.classList.add("resize");
window.scrollBy(54, 49);
inner_button.style.display = "table-row-group"
var svg = document.implementation.createDocument("http://www.w3.org/2000/svg", "svg", null);
svg.documentElement.appendChild(input);
window.scrollBy(11, 81);
inner_button.parentNode.removeChild(inner_button);
}
document.addEventListener("DOMContentLoaded", crash, false);
</script>
<button id='outer_button'>
Test passes if it does not crash.
<input id='input'>
<button id='inner_button'></button>
</input>
</button>