| Index: third_party/WebKit/LayoutTests/paint/invalidation/multiple-body-remove-selection-crash.html
|
| diff --git a/third_party/WebKit/LayoutTests/paint/invalidation/multiple-body-remove-selection-crash.html b/third_party/WebKit/LayoutTests/paint/invalidation/multiple-body-remove-selection-crash.html
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..2e4db76f467e2fbea08ed0704f80a69272ca1990
|
| --- /dev/null
|
| +++ b/third_party/WebKit/LayoutTests/paint/invalidation/multiple-body-remove-selection-crash.html
|
| @@ -0,0 +1,27 @@
|
| +<!DOCTYPE html>
|
| +<!-- Passes if doesn't crash -->
|
| +<head>
|
| +<script>
|
| +if (window.testRunner)
|
| + testRunner.dumpAsText();
|
| +
|
| +document.getElementsByTagName('script')[0].remove();
|
| +document.addEventListener('selectionchange', function() {
|
| + getSelection().deleteFromDocument();
|
| +});
|
| +onload = function() {
|
| + var newBody = document.body;
|
| + // This will create a new <body> and an empty <head>.
|
| + newBody.outerHTML = '';
|
| + newBody.className = 'new-body';
|
| + document.documentElement.insertBefore(newBody, document.head.nextSibling);
|
| + document.execCommand("SelectAll", false);
|
| + document.getElementsByTagName('body')[1].outerHTML = '';
|
| + getSelection().getRangeAt(0).extractContents();
|
| +};
|
| +</script>
|
| +<style>
|
| +* { -webkit-appearance: radio }
|
| +.new-body { backface-visibility: hidden }
|
| +</style>
|
| +</head>
|
|
|
Chromium Code Reviews
Issue 2133603002:
Fix crash when removing contents from a document having multiple bodies (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@master