Index: LayoutTests/editing/execCommand/resources/format-block-crash-iframe.html |
diff --git a/LayoutTests/editing/execCommand/resources/format-block-crash-iframe.html b/LayoutTests/editing/execCommand/resources/format-block-crash-iframe.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..350ef56be024c510e43e08f613fba40a8f70b07e |
--- /dev/null |
+++ b/LayoutTests/editing/execCommand/resources/format-block-crash-iframe.html |
@@ -0,0 +1,29 @@ |
+<!DOCTYPE html> |
+<html> |
+<head> |
+<title>FormatBlock crash test case</title> |
+</head> |
+<!-- This is a minified version of the clusterfuzz test case at https://code.google.com/p/chromium/issues/detail?id=345005 --> |
+<body style="display: table-row;"> |
+<script> |
+function run() |
+{ |
+ document.designMode = 'on'; |
+ document.execCommand('SelectAll'); |
+ document.execCommand('FormatBlock', false, '<' + 'div>'); |
+ window.setTimeout(notifyFinish, 0); |
+} |
+ |
+function notifyFinish() |
+{ |
+ window.parent.postMessage('FINISH', '*'); |
+} |
+ |
+window.setTimeout(run, 0); |
+</script> |
+<span contenteditable="true" style="display: table-caption;"></span> |
+<span></span> |
+<div style="display: -webkit-inline-box;"><span><span>B</span></span></div> |
+<div></div> |
+</body> |
+</html> |