Chromium Code Reviews Chromium Code Reviews
Issue 180003007:
Fixing crash in doApplyForSingleParagraph(). (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master| Index: LayoutTests/editing/execCommand/crash-inserting-list.html |
| diff --git a/LayoutTests/editing/execCommand/crash-inserting-list.html b/LayoutTests/editing/execCommand/crash-inserting-list.html |
| new file mode 100644 |
| index 0000000000000000000000000000000000000000..f8c8cfbafaee6ac55394a62a0c48464badb6870e |
| --- /dev/null |
| +++ b/LayoutTests/editing/execCommand/crash-inserting-list.html |
| @@ -0,0 +1,46 @@ |
| +<!DOCTYPE html> |
| +<!-- It is a minimized testcase for a Clusterfuzz test. See crbug.com/345373 --> |
| +<html> |
| +<head> |
| +<style> |
| +* { float:left; } |
| +.class0 { content: url(); } |
| +</style> |
| +</head> |
| +<body> |
| + <ul class="class0"> |
| + <li id="r0"></li> |
| + <li id="r1"></li> |
| + </ul> |
| + <hr/> |
| +</body> |
| +<script> |
|
Yuta Kitamura
2014/02/27 01:59:14
<script> cannot be a direct child of <html>.
Shoul
arpitab_
2014/02/27 05:10:07
Done.
|
| + window.testRunner() |
|
Yuta Kitamura
2014/02/27 01:59:14
"if" is missing.
arpitab_
2014/02/27 05:10:07
Done.
|
| + testRunner.dumpAsText(); |
| + |
| + var DOMNodeRemovedFireCount = 0; |
|
Yuta Kitamura
2014/02/27 01:59:14
If a variable name starts with an acronym, then
th
arpitab_
2014/02/27 05:10:07
Done.
|
| + document.addEventListener("DOMNodeRemoved", function () { |
| + if (DOMNodeRemovedFireCount >= 1) |
| + return; |
| + DOMNodeRemovedFireCount++; |
| + var element = event.srcElement; |
| + document.execCommand('InsertOrderedList', false, false); |
| + |
| + var parentElement = document.getElementById('r1'); |
| + var childElement = parentElement.childNodes[0]; |
| + parentElement.insertBefore(element, childElement); |
| + |
| + document.execCommand('Undo', false, false); |
| + document.execCommand('Redo', false, false); |
| + document.execCommand('Outdent', false, false); |
| + }, false); |
| + |
| + document.designMode = 'on'; |
| + var selection = window.getSelection(); |
| + document.execCommand('SelectAll', false); |
| + var range = selection.getRangeAt(0); |
| + var insertedElement = document.getElementById('r0'); |
| + range.insertNode(insertedElement); |
| + document.write('This test passes if the page does not crash.'); |
| +</script> |
| +</html> |
