Index: LayoutTests/editing/apply-inline-style-to-element-with-no-renderer-crash.html |
diff --git a/LayoutTests/editing/apply-inline-style-to-element-with-no-renderer-crash.html b/LayoutTests/editing/apply-inline-style-to-element-with-no-renderer-crash.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..30cfc71074a0637ab70d0fa593c3b0923f4dea3e |
--- /dev/null |
+++ b/LayoutTests/editing/apply-inline-style-to-element-with-no-renderer-crash.html |
@@ -0,0 +1,38 @@ |
+<script> |
+// crbug.com/339185: If we create an anchor element using execCommand('CreateLink') in an SVG namespace it won't get a renderer because the command will create |
+// an HTML rather than an SVG anchor. Our subsequent attempt to apply an inline style on the should fail rather than result in a crash. |
+onload = function() { |
+ tspan = document.getElementById("tspan"); |
+ tspan2 = document.getElementById("tspan2"); |
+ textPath = document.getElementById("textPath"); |
+ |
+ colorprofile = document.createElementNS('http://www.w3.org/2000/svg', 'color_profile'); |
+ li = document.createElement('li'); |
+ colorprofile.appendChild(li); |
+ document.implementation.createDocument('' ,'' ,null).adoptNode(colorprofile) |
+ |
+ input=document.createElement('input'); |
+ textPath.parentNode.insertBefore(input, textPath); |
+ window.getSelection().setBaseAndExtent(input, 4); |
+ |
+ document.designMode='on'; |
+ document.execCommand('Transpose'); |
+ document.execCommand('selectall'); |
+ document.execCommand('CreateLink', 0, '#'); |
+ document.execCommand('CreateLink', 0, '#'); |
+ document.execCommand('Undo'); |
+ document.designMode='off' |
+ document.execCommand('Undo'); |
+ document.execCommand('Undo'); |
+ document.designMode='on'; |
+ document.execCommand('italic'); |
+} |
+</script> |
+<svg> |
+ <text> |
+ <tspan id="tspan"> |
+ <tspan id="tspan2">%uef5f%u9776%u638a</tspan> |
+ <textPath id="textPath"></textPath> |
+ </tspan> |
+ </text> |
+</svg> |