| Index: LayoutTests/fast/dom/Range/range-extract-contents-after-move-to-another-document-crash.html
|
| diff --git a/LayoutTests/fast/dom/Range/range-extract-contents-after-move-to-another-document-crash.html b/LayoutTests/fast/dom/Range/range-extract-contents-after-move-to-another-document-crash.html
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..e35dc78499c02061cf8eb0a838ac183c057f2961
|
| --- /dev/null
|
| +++ b/LayoutTests/fast/dom/Range/range-extract-contents-after-move-to-another-document-crash.html
|
| @@ -0,0 +1,31 @@
|
| +<!DOCTYPE html>
|
| +<html>
|
| +<head>
|
| +<script>
|
| +if (window.testRunner)
|
| + testRunner.dumpAsText();
|
| +
|
| +onload = function() {
|
| + var target = document.getElementById('target');
|
| + var child1 = document.getElementById('c1');
|
| + var child2 = document.getElementById('c2');
|
| + var child3 = document.getElementById('c3');
|
| + document.body.removeChild(target);
|
| + var range = document.createRange();
|
| + range.selectNode(child2)
|
| + target.removeChild(child3);
|
| + var anotherDocument = document.implementation.createDocument('', null);
|
| + anotherDocument.appendChild(target);
|
| + target.appendChild(child1);
|
| +
|
| + range.extractContents();
|
| + document.body.textContent = 'PASS if Blink doesn\'t crash.';
|
| +};
|
| +</script>
|
| +</head>
|
| +<body>
|
| +<span id="target">
|
| +<b id="c1"></b><div id="c2"></div><input id="c3">
|
| +</span>
|
| +</body>
|
| +</html>
|
|
|
Chromium Code Reviews
Issue 332173003:
Update owner document of Range objects if start/end boundary points in different document (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master