summaryrefslogtreecommitdiffstats
path: root/editor/libeditor/crashtests/1402904.html
blob: 96880ce4a367f46919adcc8d60058b22cd529338 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
<script>
function jsfuzzer() {
  var option = document.getElementById("option");
  option.addEventListener("click", () => {
    document.execCommand("forwardDelete", false);
  });
  var li2 = document.getElementById("li2");
  li2.addEventListener("DOMNodeInserted", () => {
    option.click();
  });
  var select = document.getElementById("select");
  select.parentElement.setAttribute("onpageshow", "onPageShow()");
}

function onPageShow() {
  var li1 = document.getElementById("li1");
  li1.addEventListener("DOMSubtreeModified", () => {
    document.execCommand("selectAll", false);
    document.execCommand("indent", false);
  });
  li1.appendChild(document.createElement("legend"));
}
</script>
<body onload=jsfuzzer()>
<select id="select">
<option id="option"></option>
</select>
<li id="li1"></li>
<ul contenteditable="true">
<li id="li2"></li>
<embed>a;#2