| Index: LayoutTests/editing/execCommand/resources/insert-image-changing-visibility-crash-iframe.html
|
| diff --git a/LayoutTests/editing/execCommand/resources/insert-image-changing-visibility-crash-iframe.html b/LayoutTests/editing/execCommand/resources/insert-image-changing-visibility-crash-iframe.html
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..88f57c9dca2ad5035aae6cd1b695122750ae4c55
|
| --- /dev/null
|
| +++ b/LayoutTests/editing/execCommand/resources/insert-image-changing-visibility-crash-iframe.html
|
| @@ -0,0 +1,33 @@
|
| +<!DOCTYPE html>
|
| +<html>
|
| +<head>
|
| +<title>Issue 348283 crash test case</title>
|
| +<style>
|
| +table {
|
| + visibility: collapse;
|
| +}
|
| +
|
| +*:only-child {
|
| + visibility: visible;
|
| +}
|
| +</style>
|
| +</head>
|
| +<!-- This is a minified version of the clusterfuzz test case at https://code.google.com/p/chromium/issues/detail?id=348283 -->
|
| +<body contenteditable="true">
|
| +<script>
|
| +window.onload = function () {
|
| + var table = document.getElementById('table');
|
| + table.insertAdjacentHTML('afterbegin', '<svg></svg><div><div id=\'div\'>text</div>');
|
| +
|
| + var div = document.getElementById('div');
|
| + var selection = window.getSelection();
|
| + selection.collapse(div.firstChild, 0);
|
| + document.execCommand('InsertImage', false, 'about:blank');
|
| + window.parent.postMessage('FINISH', '*');
|
| +};
|
| +</script>
|
| +
|
| +<table id="table" ></table>
|
| +<div></div>
|
| +</body>
|
| +</html>
|
|
|
Chromium Code Reviews
Issue 183893018:
Check VisualPosition.isNull() after DOM mutation in ReplaceSelectionCommand (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master