Index: LayoutTests/editing/execCommand/unlistify-body-crash.html |
diff --git a/LayoutTests/editing/execCommand/unlistify-body-crash.html b/LayoutTests/editing/execCommand/unlistify-body-crash.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..1ab1cb19431761b9126ede16293bc3ea16aa1add |
--- /dev/null |
+++ b/LayoutTests/editing/execCommand/unlistify-body-crash.html |
@@ -0,0 +1,29 @@ |
+<!DOCTYPE html> |
+<html> |
+<head> |
+<script> |
+if (window.testRunner) |
+ testRunner.dumpAsText(); |
+ |
+function doReplace(tagName) { |
+ var oldElement = document.getElementById(tagName); |
+ var newElement = document.createElement(tagName); |
+ while (oldElement.firstChild) { |
+ newElement.appendChild(oldElement.firstChild); |
+ } |
+ oldElement.parentNode.replaceChild(newElement, oldElement); |
+} |
+onload = function() { |
+ doReplace('body'); |
+ |
+ document.designMode = 'on'; |
+ getSelection().collapse(document.querySelector('li'), 1); |
+ document.execCommand('InsertUnorderedList'); |
+ document.documentElement.textContent = 'PASS if Blink doesn\'t crash.'; |
+}; |
+</script> |
+</head> |
+<body> |
+<h6><ul><li><div id="body"><h6>bar<ul></ul></h6></div><br></li></ul></h6> |
+</body> |
+</html> |