| Index: LayoutTests/editing/execCommand/crash-inserting-list.html
|
| diff --git a/LayoutTests/editing/execCommand/crash-inserting-list.html b/LayoutTests/editing/execCommand/crash-inserting-list.html
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..41a19a319dec2fcf08ddd7d0a3d4560780d2537c
|
| --- /dev/null
|
| +++ b/LayoutTests/editing/execCommand/crash-inserting-list.html
|
| @@ -0,0 +1,46 @@
|
| +<!DOCTYPE html>
|
| +<!-- It is a minimized testcase for a Clusterfuzz test. See crbug.com/345373 -->
|
| +<html>
|
| +<head>
|
| +<style>
|
| +* { float:left; }
|
| +.class0 { content: url(); }
|
| +</style>
|
| +</head>
|
| +<body>
|
| +<ul class="class0">
|
| + <li id="r0"></li>
|
| + <li id="r1"></li>
|
| +</ul>
|
| +<hr/>
|
| +<script>
|
| + if (window.testRunner)
|
| + testRunner.dumpAsText();
|
| +
|
| + var domNodeRemovedFireCount = 0;
|
| + document.addEventListener("DOMNodeRemoved", function () {
|
| + if (domNodeRemovedFireCount >= 1)
|
| + return;
|
| + domNodeRemovedFireCount++;
|
| + var element = event.srcElement;
|
| + document.execCommand('InsertOrderedList', false, false);
|
| +
|
| + var parentElement = document.getElementById('r1');
|
| + var childElement = parentElement.childNodes[0];
|
| + parentElement.insertBefore(element, childElement);
|
| +
|
| + document.execCommand('Undo', false, false);
|
| + document.execCommand('Redo', false, false);
|
| + document.execCommand('Outdent', false, false);
|
| + }, false);
|
| +
|
| + document.designMode = 'on';
|
| + var selection = window.getSelection();
|
| + document.execCommand('SelectAll', false);
|
| + var range = selection.getRangeAt(0);
|
| + var insertedElement = document.getElementById('r0');
|
| + range.insertNode(insertedElement);
|
| + document.write('This test passes if the page does not crash.');
|
| +</script>
|
| +</body>
|
| +</html>
|
|
|
Chromium Code Reviews
Issue 180003007:
Fixing crash in doApplyForSingleParagraph(). (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master