Index: LayoutTests/editing/execCommand/resources/insert-image-changing-visibility-crash-iframe.html |
diff --git a/LayoutTests/editing/execCommand/resources/insert-image-changing-visibility-crash-iframe.html b/LayoutTests/editing/execCommand/resources/insert-image-changing-visibility-crash-iframe.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..341254e6e47d80f2d1563aeb219f8b880df426d0 |
--- /dev/null |
+++ b/LayoutTests/editing/execCommand/resources/insert-image-changing-visibility-crash-iframe.html |
@@ -0,0 +1,32 @@ |
+<!DOCTYPE html> |
+<html> |
+<head> |
+<title>Issue 348283 crash test case</title> |
+</head> |
+<!-- This is a minified version of the clusterfuzz test case at https://code.google.com/p/chromium/issues/detail?id=348283 --> |
+<body contenteditable="true"> |
+<script> |
+window.onload = function () { |
+ var table = document.getElementById("table"); |
+ table.insertAdjacentHTML('afterbegin', "<svg/><div><div id=\"div\">text</div>"); |
Yuta Kitamura
2014/03/04 06:36:18
nit: Don't use both '' and "" for string literals
yoichio
2014/03/04 07:05:56
Done.
|
+ |
+ var div = document.getElementById("div"); |
+ var selection = window.getSelection(); |
+ selection.collapse(div.firstChild, 0); |
+ document.execCommand('InsertImage', false, 'about:blank'); |
+ window.parent.postMessage('FINISH', '*'); |
+}; |
+</script> |
+<style> |
Yuta Kitamura
2014/03/04 06:36:18
nit: <style> usually appears within <head>.
yoichio
2014/03/04 07:05:56
Done.
|
+table { |
+ visibility: collapse; |
+} |
+ |
+*:only-child { |
+ visibility: visible; |
+} |
+</style> |
+<table id="table" /> |
Yuta Kitamura
2014/03/04 06:36:18
nit: "<xxx />"-style tag should probably only be u
yoichio
2014/03/04 07:05:56
Done.
|
+<div /> |
+</body> |
+</html> |