summaryrefslogtreecommitdiffstats
path: root/editor/libeditor/crashtests
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-19 00:47:55 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-19 00:47:55 +0000
commit26a029d407be480d791972afb5975cf62c9360a6 (patch)
treef435a8308119effd964b339f76abb83a57c29483 /editor/libeditor/crashtests
parentInitial commit. (diff)
downloadfirefox-26a029d407be480d791972afb5975cf62c9360a6.tar.xz
firefox-26a029d407be480d791972afb5975cf62c9360a6.zip
Adding upstream version 124.0.1.upstream/124.0.1
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'editor/libeditor/crashtests')
-rw-r--r--editor/libeditor/crashtests/1057677.html9
-rw-r--r--editor/libeditor/crashtests/1128787.html17
-rw-r--r--editor/libeditor/crashtests/1134545.html26
-rw-r--r--editor/libeditor/crashtests/1158452.html10
-rw-r--r--editor/libeditor/crashtests/1158651.html18
-rw-r--r--editor/libeditor/crashtests/1244894.xhtml21
-rw-r--r--editor/libeditor/crashtests/1264921.html1
-rw-r--r--editor/libeditor/crashtests/1272490.html20
-rw-r--r--editor/libeditor/crashtests/1274050.html17
-rw-r--r--editor/libeditor/crashtests/1317704.html42
-rw-r--r--editor/libeditor/crashtests/1317718.html14
-rw-r--r--editor/libeditor/crashtests/1324505.html24
-rw-r--r--editor/libeditor/crashtests/1343918.html21
-rw-r--r--editor/libeditor/crashtests/1344097.html20
-rw-r--r--editor/libeditor/crashtests/1345015.html28
-rw-r--r--editor/libeditor/crashtests/1348851.html19
-rw-r--r--editor/libeditor/crashtests/1350772.html16
-rw-r--r--editor/libeditor/crashtests/1364133.html42
-rw-r--r--editor/libeditor/crashtests/1366176.html30
-rw-r--r--editor/libeditor/crashtests/1375131.html33
-rw-r--r--editor/libeditor/crashtests/1381541.html20
-rw-r--r--editor/libeditor/crashtests/1383747.html15
-rw-r--r--editor/libeditor/crashtests/1383755.html26
-rw-r--r--editor/libeditor/crashtests/1383763.html17
-rw-r--r--editor/libeditor/crashtests/1384161.html17
-rw-r--r--editor/libeditor/crashtests/1388075.html60
-rw-r--r--editor/libeditor/crashtests/1393171.html10
-rw-r--r--editor/libeditor/crashtests/1402196.html29
-rw-r--r--editor/libeditor/crashtests/1402469.html22
-rw-r--r--editor/libeditor/crashtests/1402526.html24
-rw-r--r--editor/libeditor/crashtests/1402904.html38
-rw-r--r--editor/libeditor/crashtests/1405747.html40
-rw-r--r--editor/libeditor/crashtests/1405897.html23
-rw-r--r--editor/libeditor/crashtests/1408170.html40
-rw-r--r--editor/libeditor/crashtests/1414581.html31
-rw-r--r--editor/libeditor/crashtests/1415231.html26
-rw-r--r--editor/libeditor/crashtests/1423767.html17
-rw-r--r--editor/libeditor/crashtests/1423776.html25
-rw-r--r--editor/libeditor/crashtests/1424450.html51
-rw-r--r--editor/libeditor/crashtests/1425091.html25
-rw-r--r--editor/libeditor/crashtests/1426709.html27
-rw-r--r--editor/libeditor/crashtests/1429523.html18
-rw-r--r--editor/libeditor/crashtests/1429523.xhtml18
-rw-r--r--editor/libeditor/crashtests/1441619.html12
-rw-r--r--editor/libeditor/crashtests/1443664.html15
-rw-r--r--editor/libeditor/crashtests/1444630.html29
-rw-r--r--editor/libeditor/crashtests/1446451.html13
-rw-r--r--editor/libeditor/crashtests/1464251.html25
-rw-r--r--editor/libeditor/crashtests/1470926.html9
-rw-r--r--editor/libeditor/crashtests/1474978.html21
-rw-r--r--editor/libeditor/crashtests/1517028.html23
-rw-r--r--editor/libeditor/crashtests/1525481.html23
-rw-r--r--editor/libeditor/crashtests/1533913.html19
-rw-r--r--editor/libeditor/crashtests/1534394.html29
-rw-r--r--editor/libeditor/crashtests/1547897.html25
-rw-r--r--editor/libeditor/crashtests/1547898.html16
-rw-r--r--editor/libeditor/crashtests/1556799.html18
-rw-r--r--editor/libeditor/crashtests/1574544.html17
-rw-r--r--editor/libeditor/crashtests/1578916.html28
-rw-r--r--editor/libeditor/crashtests/1579934.html39
-rw-r--r--editor/libeditor/crashtests/1581246.html21
-rw-r--r--editor/libeditor/crashtests/1596516.html18
-rw-r--r--editor/libeditor/crashtests/1605741.html14
-rw-r--r--editor/libeditor/crashtests/1613521.html16
-rw-r--r--editor/libeditor/crashtests/1618906.html17
-rw-r--r--editor/libeditor/crashtests/1623166.html21
-rw-r--r--editor/libeditor/crashtests/1623913.html30
-rw-r--r--editor/libeditor/crashtests/1624005.html14
-rw-r--r--editor/libeditor/crashtests/1624007.html19
-rw-r--r--editor/libeditor/crashtests/1624011.html12
-rw-r--r--editor/libeditor/crashtests/1626002.html27
-rw-r--r--editor/libeditor/crashtests/1636541.html14
-rw-r--r--editor/libeditor/crashtests/1644903.html19
-rw-r--r--editor/libeditor/crashtests/1645983-1.html11
-rw-r--r--editor/libeditor/crashtests/1645983-2.html14
-rw-r--r--editor/libeditor/crashtests/1648564.html29
-rw-r--r--editor/libeditor/crashtests/1655508.html34
-rw-r--r--editor/libeditor/crashtests/1655539.html15
-rw-r--r--editor/libeditor/crashtests/1655988.html29
-rw-r--r--editor/libeditor/crashtests/1659717.html14
-rw-r--r--editor/libeditor/crashtests/1663725.html18
-rw-r--r--editor/libeditor/crashtests/1666556.html28
-rw-r--r--editor/libeditor/crashtests/1677566.html31
-rw-r--r--editor/libeditor/crashtests/1691051.html15
-rw-r--r--editor/libeditor/crashtests/1699866.html22
-rw-r--r--editor/libeditor/crashtests/1701348.html10
-rw-r--r--editor/libeditor/crashtests/1707630.html16
-rw-r--r--editor/libeditor/crashtests/336081-1.xhtml52
-rw-r--r--editor/libeditor/crashtests/403965-1.xhtml7
-rw-r--r--editor/libeditor/crashtests/428489-1.html8
-rw-r--r--editor/libeditor/crashtests/429586-1.html8
-rw-r--r--editor/libeditor/crashtests/431086-1.xhtml22
-rw-r--r--editor/libeditor/crashtests/475132-1.xhtml21
-rw-r--r--editor/libeditor/crashtests/503709-1.xhtml11
-rw-r--r--editor/libeditor/crashtests/513375-1.xhtml19
-rw-r--r--editor/libeditor/crashtests/535632-1.xhtml1
-rw-r--r--editor/libeditor/crashtests/574558-1.xhtml15
-rw-r--r--editor/libeditor/crashtests/580151-1.xhtml26
-rw-r--r--editor/libeditor/crashtests/582138-1.xhtml10
-rw-r--r--editor/libeditor/crashtests/633709.xhtml68
-rw-r--r--editor/libeditor/crashtests/639736-1.xhtml19
-rw-r--r--editor/libeditor/crashtests/713427-2.xhtml28
-rw-r--r--editor/libeditor/crashtests/766360.html18
-rw-r--r--editor/libeditor/crashtests/766387.html21
-rw-r--r--editor/libeditor/crashtests/766413.html42
-rw-r--r--editor/libeditor/crashtests/766795.html21
-rw-r--r--editor/libeditor/crashtests/766845.xhtml27
-rw-r--r--editor/libeditor/crashtests/767169.html23
-rw-r--r--editor/libeditor/crashtests/768748.html16
-rw-r--r--editor/libeditor/crashtests/768765.html36
-rw-r--r--editor/libeditor/crashtests/769008-1.html23
-rw-r--r--editor/libeditor/crashtests/769967.xhtml16
-rw-r--r--editor/libeditor/crashtests/771749.html21
-rw-r--r--editor/libeditor/crashtests/772282.html27
-rw-r--r--editor/libeditor/crashtests/776323.html18
-rw-r--r--editor/libeditor/crashtests/793866.html21
-rw-r--r--editor/libeditor/crashtests/848644.html2
-rw-r--r--editor/libeditor/crashtests/crashtests.list117
118 files changed, 2700 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/1057677.html b/editor/libeditor/crashtests/1057677.html
new file mode 100644
index 0000000000..d0b9497a5a
--- /dev/null
+++ b/editor/libeditor/crashtests/1057677.html
@@ -0,0 +1,9 @@
+<html><body></body><script>
+document.designMode = "on";
+var hrElem = document.createElement("HR");
+var select = window.getSelection();
+document.body.appendChild(hrElem);
+select.collapse(hrElem,0);
+document.execCommand("InsertHTML", false, "<div>foo</div><div>bar</div>");
+</script>
+</html>
diff --git a/editor/libeditor/crashtests/1128787.html b/editor/libeditor/crashtests/1128787.html
new file mode 100644
index 0000000000..fc6bff0972
--- /dev/null
+++ b/editor/libeditor/crashtests/1128787.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Bug 1128787</title>
+</head>
+<body>
+ <input type="button"/>
+ <script>
+ window.onload = function () {
+ document.designMode = "on";
+ }
+ var input = document.getElementsByTagName("input")[0];
+ input.focus();
+ input.type = "text";
+ </script>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1134545.html b/editor/libeditor/crashtests/1134545.html
new file mode 100644
index 0000000000..d09fd6beb3
--- /dev/null
+++ b/editor/libeditor/crashtests/1134545.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<!-- saved from url=(0065)https://bug1134545.bugzilla.mozilla.org/attachment.cgi?id=8566418 -->
+<html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
+<script>
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text at end of the <body>.
+ getSelection().collapse(
+ document.body.lastChild,
+ document.body.lastChild.length
+ );
+ const textNode = document.createTextNode(" ");
+ const editingHost = document.querySelector("div[contenteditable]");
+ editingHost.appendChild(textNode);
+ editingHost.setAttribute('contenteditable', "true");
+ textNode.remove();
+ getSelection().selectAllChildren(textNode);
+ document.execCommand("increasefontsize");
+}
+</script>
+</head>
+<body onload="onLoad();">
+<div contenteditable></div>
+
+
+</body></html> \ No newline at end of file
diff --git a/editor/libeditor/crashtests/1158452.html b/editor/libeditor/crashtests/1158452.html
new file mode 100644
index 0000000000..56c74abd61
--- /dev/null
+++ b/editor/libeditor/crashtests/1158452.html
@@ -0,0 +1,10 @@
+
+<div>
+<div>
+aaaaaaa
+</script>
+<script type="text/javascript">
+document.designMode = "on"
+window.getSelection().modify("extend", "backward", "line")
+document.execCommand("increasefontsize","",null);
+</script>
diff --git a/editor/libeditor/crashtests/1158651.html b/editor/libeditor/crashtests/1158651.html
new file mode 100644
index 0000000000..27278b5234
--- /dev/null
+++ b/editor/libeditor/crashtests/1158651.html
@@ -0,0 +1,18 @@
+<script>
+onload = function() {
+ var testContainer = document.createElement("span");
+ testContainer.contentEditable = true;
+ document.body.appendChild(testContainer);
+
+ function queryFormatBlock(content)
+ {
+ testContainer.innerHTML = content;
+ while (testContainer.firstChild)
+ testContainer = testContainer.firstChild;
+ window.getSelection().collapse(testContainer, 0);
+ document.queryCommandValue('formatBlock');
+ }
+
+ queryFormatBlock('<ol>hello</ol>');
+};
+</script>
diff --git a/editor/libeditor/crashtests/1244894.xhtml b/editor/libeditor/crashtests/1244894.xhtml
new file mode 100644
index 0000000000..89a24751e9
--- /dev/null
+++ b/editor/libeditor/crashtests/1244894.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+ document.designMode = 'on';
+ document.execCommand("indent", false, null);
+ document.execCommand("insertText", false, "a");
+ document.execCommand("forwardDelete", false, null);
+ document.execCommand("justifyfull", false, null);
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+</head>
+
+<body> <span class="v"></span></body><body><input type="file" /></body>
+
+</html>
diff --git a/editor/libeditor/crashtests/1264921.html b/editor/libeditor/crashtests/1264921.html
new file mode 100644
index 0000000000..b53fcb5fd4
--- /dev/null
+++ b/editor/libeditor/crashtests/1264921.html
@@ -0,0 +1 @@
+<body style=display:table-footer-group onload=d=document;h=d.all[0];h.appendChild(d.createElement("input"));h.appendChild(d.createElement("iframe"));d.designMode="on"> \ No newline at end of file
diff --git a/editor/libeditor/crashtests/1272490.html b/editor/libeditor/crashtests/1272490.html
new file mode 100644
index 0000000000..2a8f1d9f9c
--- /dev/null
+++ b/editor/libeditor/crashtests/1272490.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+window.onload = function () {
+ var childDocument = document.getElementsByTagName("iframe")[0].contentDocument;
+ childDocument.designMode = "on";
+ function onAttrModified(aEvent) {
+ childDocument.removeEventListener("DOMAttrModified", onAttrModified);
+ // Remove the editor from document during executing "insertOrderedList".
+ document.body.innerHTML = "";
+ }
+ childDocument.addEventListener("DOMAttrModified", onAttrModified);
+ childDocument.execCommand("insertOrderedList", false, "1");
+}
+</script>
+</head>
+<body><iframe></iframe></body>
+</html>
diff --git a/editor/libeditor/crashtests/1274050.html b/editor/libeditor/crashtests/1274050.html
new file mode 100644
index 0000000000..5b7a5613ef
--- /dev/null
+++ b/editor/libeditor/crashtests/1274050.html
@@ -0,0 +1,17 @@
+<body>
+<table contenteditable></table>
+</body>
+<script>
+window.onload = function() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node at end of the <body>.
+ getSelection().collapse(
+ document.body.lastChild,
+ document.body.lastChild.length
+ );
+ document.execCommand("styleWithCSS", false, false);
+ document.designMode = "on";
+ document.execCommand("insertUnorderedList");
+ document.execCommand("justifyFull");
+};
+</script>
diff --git a/editor/libeditor/crashtests/1317704.html b/editor/libeditor/crashtests/1317704.html
new file mode 100644
index 0000000000..2f6d2820c3
--- /dev/null
+++ b/editor/libeditor/crashtests/1317704.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+addEventListener('DOMContentLoaded', () => {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node at end of the <body>.
+ getSelection().collapse(
+ document.body.lastChild,
+ document.body.lastChild.length
+ );
+ document.documentElement.className = 'lizard';
+ setTimeout(() => {
+ document.execCommand('selectAll');
+ document.designMode = 'on';
+ document.execCommand('removeformat');
+ }, 0);
+});
+</script>
+<style>
+.lizard {
+ -webkit-user-select: all;
+}
+* {
+ position: fixed;
+ display: table-column;
+}
+</style>
+</head>
+<body>
+<span>
+<span contenteditable>
+<span class=lizard></span>
+<span class=lizard></span>
+<span />
+</span>
+</span>
+</span>
+</span>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1317718.html b/editor/libeditor/crashtests/1317718.html
new file mode 100644
index 0000000000..892b8aee31
--- /dev/null
+++ b/editor/libeditor/crashtests/1317718.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<script>
+addEventListener('DOMContentLoaded', function() {
+ let root = document.documentElement;
+ while(root.firstChild) {
+ root.firstChild.remove();
+ }
+ document.designMode = 'on';
+ document.removeChild(document.documentElement);
+ document.execCommand('justifyleft', false, null);
+});
+</script>
+</html>
diff --git a/editor/libeditor/crashtests/1324505.html b/editor/libeditor/crashtests/1324505.html
new file mode 100644
index 0000000000..4872b9f05d
--- /dev/null
+++ b/editor/libeditor/crashtests/1324505.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<script>
+addEventListener("DOMContentLoaded", function(){
+ let root = document.documentElement;
+ while(root.firstChild) {
+ root.firstChild.remove();
+ }
+ let o_0 = document.createElement("body");
+ root.appendChild(o_0);
+ o_0.appendChild(document.createElement("table"));
+ o_0.appendChild(document.createElement("canvas"));
+ let o_1 = document.createElement("canvas");
+ o_0.appendChild(o_1);
+ o_1.setAttribute("contenteditable", "true");
+ setTimeout(function(){
+ document.execCommand("selectAll", false, "Marker felt");
+ document.designMode = 'on';
+ document.execCommand("insertorderedlist", false, null);
+ document.execCommand("insertorderedlist", false, null);
+ }, 0);
+});
+</script>
+</html>
diff --git a/editor/libeditor/crashtests/1343918.html b/editor/libeditor/crashtests/1343918.html
new file mode 100644
index 0000000000..24a3d9041f
--- /dev/null
+++ b/editor/libeditor/crashtests/1343918.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <script type="application/javascript">
+ let form = document.createElement('form');
+ let input1 = document.createElement('input');
+ let input2 = document.createElement('input');
+ document.documentElement.appendChild(form);
+ document.documentElement.appendChild(input1);
+ form.appendChild(input2);
+ form.contentEditable = true
+ input1.focus();
+
+ let range = document.createRange();
+ range.selectNode(input2);
+ window.getSelection().addRange(range);
+ document.execCommand("italic", false, null);
+ </script>
+ </head>
+ <body></body>
+</html>
diff --git a/editor/libeditor/crashtests/1344097.html b/editor/libeditor/crashtests/1344097.html
new file mode 100644
index 0000000000..7f76957c5a
--- /dev/null
+++ b/editor/libeditor/crashtests/1344097.html
@@ -0,0 +1,20 @@
+<html>
+ <head>
+ <script></script>
+ <script>
+ document.designMode = 'on';
+ o1 = window.getSelection();
+ o2 = document.createElement('code');
+ o3 = document.createElement('style');
+ o4 = document.createElement('style');
+ document.head.appendChild(o3);
+ o1.modify("move", "right", "character");
+ document.styleSheets[0].insertRule("* { position: absolute; }", 0);
+ document.head.appendChild(o4);
+ window.resizeTo(1,1);
+ document.documentElement.appendChild(o2);
+ o1.selectAllChildren(o2);
+ </script>
+ </head>
+ <body></body>
+</html>
diff --git a/editor/libeditor/crashtests/1345015.html b/editor/libeditor/crashtests/1345015.html
new file mode 100644
index 0000000000..3781469578
--- /dev/null
+++ b/editor/libeditor/crashtests/1345015.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <script type="application/javascript">
+ document.designMode = "on";
+ let selection = window.getSelection();
+
+ let foo = document.createElement('foo');
+ let div = document.createElement('div');
+ document.documentElement.appendChild(foo);
+ document.documentElement.appendChild(div);
+ foo.outerHTML = '<foo>';
+
+ let range = document.createRange();
+ range.selectNode(div);
+ selection.addRange(range);
+ range.setStart(foo, 0);
+
+ range = document.createRange();
+ range.selectNode(document.documentElement);
+ selection.addRange(range);
+
+ document.execCommand('insertparagraph', false, null);
+ </script>
+ </head>
+ <body>
+ </body>
+</html>
diff --git a/editor/libeditor/crashtests/1348851.html b/editor/libeditor/crashtests/1348851.html
new file mode 100644
index 0000000000..d618f049ee
--- /dev/null
+++ b/editor/libeditor/crashtests/1348851.html
@@ -0,0 +1,19 @@
+<!DOCTYPE>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+function boom(){
+ document.designMode = "on";
+ document.execCommand("insertlinebreak");
+ document.designMode = "off";
+ document.designMode = "on";
+ document.execCommand("insertunorderedlist");
+}
+addEventListener("DOMContentLoaded", boom);
+</script>
+</head>
+<body style="display:flex;">
+<!--comment-->
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1350772.html b/editor/libeditor/crashtests/1350772.html
new file mode 100644
index 0000000000..e20481527d
--- /dev/null
+++ b/editor/libeditor/crashtests/1350772.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+addEventListener("DOMContentLoaded", () => {
+ try {
+ document.designMode = 'on';
+ document.removeChild(document.documentElement);
+ document.appendChild(document.createElement("p"));
+ document.execCommand("insertParagraph", false, null);
+ } catch(e) {
+ }
+});
+</script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1364133.html b/editor/libeditor/crashtests/1364133.html
new file mode 100644
index 0000000000..a1d06fba98
--- /dev/null
+++ b/editor/libeditor/crashtests/1364133.html
@@ -0,0 +1,42 @@
+<html>
+ <head>
+ <script>
+ var tr = document.createElement('tr');
+ document.documentElement.appendChild(tr);
+
+ var a1 = document.createElement('a');
+ document.documentElement.appendChild(a1);
+ var a2 = document.createElement('a');
+ tr.appendChild(a2);
+
+ var a3 = document.createElement('a');
+ document.documentElement.appendChild(a3);
+
+ var a4 = document.createElement('a');
+ document.documentElement.appendChild(a4);
+
+ var a5 = document.createElement('a');
+ a1.appendChild(a5);
+
+ var input = document.createElement('input');
+ document.documentElement.appendChild(input);
+
+ a3.contentEditable = true;
+ a5.innerText = "xx";
+ a4.outerHTML = "";
+ input.select();
+
+ document.replaceChild(document.documentElement, document.documentElement);
+ window.find("x", false, false, false, false, false, false);
+
+ var range = document.createRange();
+ range.setStart(a1, 1);
+ window.getSelection().addRange(range);
+
+ document.designMode = "on";
+
+ range.selectNode(a2);
+ document.execCommand("forecolor", false, "-moz-default-background-color");
+ </script>
+ </head>
+</html>
diff --git a/editor/libeditor/crashtests/1366176.html b/editor/libeditor/crashtests/1366176.html
new file mode 100644
index 0000000000..cf6841c650
--- /dev/null
+++ b/editor/libeditor/crashtests/1366176.html
@@ -0,0 +1,30 @@
+<html>
+<head>
+ <script>
+
+ function go()
+ {
+ try { o114 = document.createElement('canvas'); } catch(e) {;}
+ try { o103 = (new DOMParser).parseFromString('/', 'text/html'); } catch(e) {;}
+ try { o217 = o103.all[1]; } catch(e) {;}
+ try { o253 = window.getSelection(); } catch(e) {;}
+
+ try { o270 = document.body.appendChild(document.createElement('a')); } catch(e) {;}
+
+ try { o301 = window.getSelection(); } catch(e) {;}
+ try { o314 = window.getSelection(); } catch(e) {;}
+ try { document.body.appendChild(o114); } catch(e) {;}
+ try { document.documentElement.appendChild(o217); } catch(e) {;}
+ try { document.body.appendChild(o270); } catch(e) {;}
+ try { o217.contentEditable = true } catch(e) {;}
+
+ try { o253.modify('move','forward','lineboundary'); } catch(e) {;}
+ try { o314.modify('extend','left','line'); } catch(e) {;}
+ try { o301.modify('extend','right','line'); } catch(e) {;}
+ }
+ </script>
+</head>
+<body onload="go();">
+ <plaintext></plaintext>
+</bdoy>
+</html>
diff --git a/editor/libeditor/crashtests/1375131.html b/editor/libeditor/crashtests/1375131.html
new file mode 100644
index 0000000000..4060cf3d4c
--- /dev/null
+++ b/editor/libeditor/crashtests/1375131.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <script type="application/javascript">
+ document.designMode = 'on';
+
+ let div = document.createElement('div');
+ let p = document.createElement('p');
+ document.documentElement.appendChild(div);
+ document.documentElement.appendChild(
+ document.createElement('body'));
+ document.documentElement.appendChild(p);
+ document.execCommand('insertimage', false, 'http://localhost/');
+ document.execCommand('insertparagraph', false, null);
+
+ document.elementFromPoint(0, 0);
+
+ let selection = window.getSelection();
+ selection.modify('extend', 'forward', 'character');
+
+ let range = document.createRange();
+ range.selectNode(p);
+ selection.addRange(range);
+ range.setStart(div, 0);
+
+ range = document.createRange();
+ range.selectNode(p);
+ selection.addRange(range);
+
+ document.execCommand('delete', false, null);
+ </script>
+ </head>
+</html>
diff --git a/editor/libeditor/crashtests/1381541.html b/editor/libeditor/crashtests/1381541.html
new file mode 100644
index 0000000000..8902e3d032
--- /dev/null
+++ b/editor/libeditor/crashtests/1381541.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <script type="application/javascript">
+ var editable = document.createElement('div');
+ document.documentElement.appendChild(editable);
+ editable.contentEditable = 'true';
+ var div = document.createElement('div');
+ document.documentElement.appendChild(div);
+ // Flush content
+ div.offsetLeft;
+ document.execCommand('styleWithCSS', false, true);
+
+ var range = new Range();
+ window.getSelection().addRange(range);
+ range.setStart(document.createTextNode(''), 0);
+ document.queryCommandState('backcolor');
+ </script>
+ </head>
+</html>
diff --git a/editor/libeditor/crashtests/1383747.html b/editor/libeditor/crashtests/1383747.html
new file mode 100644
index 0000000000..1c926cc7ea
--- /dev/null
+++ b/editor/libeditor/crashtests/1383747.html
@@ -0,0 +1,15 @@
+<html>
+ <head>
+ <script>
+ try { o1 = window.getSelection() } catch(e) { }
+ try { o2 = document.createElement('map') } catch(e) { };
+ try { o3 = document.createElement('select') } catch(e) { }
+ try { document.documentElement.appendChild(o2) } catch(e) { };
+ try { o2.contentEditable = 'true' } catch(e) { };
+ try { o2.offsetTop } catch(e) { };
+ try { document.replaceChild(document.implementation.createHTMLDocument().documentElement, document.documentElement); } catch(e) { }
+ try { document.documentElement.appendChild(o3) } catch(e) { }
+ try { o1.modify('extend', 'forward', 'word') } catch(e) { }
+ </script>
+ </head>
+</html> \ No newline at end of file
diff --git a/editor/libeditor/crashtests/1383755.html b/editor/libeditor/crashtests/1383755.html
new file mode 100644
index 0000000000..3cbfe08d17
--- /dev/null
+++ b/editor/libeditor/crashtests/1383755.html
@@ -0,0 +1,26 @@
+<html>
+ <head>
+ <script type="application/javascript">
+ let table = document.createElement('table');
+ document.documentElement.appendChild(table);
+ let tr = document.createElement('tr');
+ table.appendChild(tr);
+ let input = document.createElement('input');
+ document.documentElement.appendChild(input);
+
+ let img = document.createElement('img');
+ input.appendChild(img);
+ img.contentEditable = 'true'
+ tr.appendChild(img);
+ img.offsetParent;
+
+ // Since table's cell is selected by the following, it will show
+ // object resizer that is anonymous element.
+ window.getSelection().selectAllChildren(tr);
+ // Document.adoptNode will remove anonymous element of object resizer
+ // and it shouldn't cause crash
+ document.implementation.createDocument('', '').adoptNode(table);
+ </script>
+ </head>
+</html>
+
diff --git a/editor/libeditor/crashtests/1383763.html b/editor/libeditor/crashtests/1383763.html
new file mode 100644
index 0000000000..a97d685368
--- /dev/null
+++ b/editor/libeditor/crashtests/1383763.html
@@ -0,0 +1,17 @@
+<xsl:stylesheet id='xsl'>
+<script id='script'>
+try { o1 = document.createElement('table') } catch(e) { }
+try { o3 = document.createElement('area') } catch(e) { }
+try { o4 = document.createElement('script'); } catch(e) { }
+try { o5 = document.getSelection() } catch(e) { }
+try { document.implementation.createDocument('', '', null).adoptNode(o1); } catch(e) { }
+try { o1.appendChild(o3) } catch(e) { }
+try { o5.addRange(new Range()); } catch(e) { }
+try { document.documentElement.appendChild(o4) } catch(e) { }
+try { o4.textContent = 'XX' } catch(e) { }
+try { o7 = o4.firstChild } catch(e) { }
+try { o4.parentNode.insertBefore(o7, o4); } catch(e) { }
+try { o5.modify('extend', 'forward', 'line') } catch(e) { }
+try { o5.selectAllChildren(o3) } catch(e) { }
+try { o7.splitText(1) } catch(e) { }
+</script> \ No newline at end of file
diff --git a/editor/libeditor/crashtests/1384161.html b/editor/libeditor/crashtests/1384161.html
new file mode 100644
index 0000000000..c7d8ccc292
--- /dev/null
+++ b/editor/libeditor/crashtests/1384161.html
@@ -0,0 +1,17 @@
+<html>
+ <head>
+ <script>
+ try { o1 = document.createElement('caption') } catch(e) { }
+ try { o2 = document.createElement('select') } catch(e) { }
+ try { o3 = document.createElement('map') } catch(e) { }
+ try { o4 = window.getSelection() } catch(e) { }
+ try { document.documentElement.appendChild(o1) } catch(e) { }
+ try { o1.style.display = 'contents' } catch(e) { }
+ try { document.prepend(o2, document) } catch(e) { }
+ try { document.designMode = 'on'; } catch(e) { }
+ try { o3.ownerDocument.execCommand('outdent', false, null) } catch(e) { }
+ try { document.designMode = 'off'; } catch(e) { }
+ try { o4.extend(o2, 0) } catch(e) { }
+ </script>
+ </head>
+</html> \ No newline at end of file
diff --git a/editor/libeditor/crashtests/1388075.html b/editor/libeditor/crashtests/1388075.html
new file mode 100644
index 0000000000..c539f97d57
--- /dev/null
+++ b/editor/libeditor/crashtests/1388075.html
@@ -0,0 +1,60 @@
+<html>
+<head>
+<script>
+try {
+ var style = document.createElement("style");
+} catch(e) {}
+try {
+ var output = document.createElement("output");
+} catch(e) {}
+try {
+ var input = document.createElement("input");
+} catch(e) {}
+try {
+ var script = document.createElement("script");
+} catch(e) {}
+try {
+ var clonedOutput = output.cloneNode(false);
+} catch(e) {}
+try {
+ document.documentElement.appendChild(style);
+} catch(e) {}
+try {
+ style.outerHTML = '<a contenteditable="true">';
+} catch(e) {}
+// For emulating the traditional behavior, collapse Selection to end of the
+// <body> which must be empty (<style> was added after the <body>).
+getSelection().collapse(document.body, document.body.childNodes.length);
+try {
+ document.documentElement.appendChild(input);
+} catch(e) {}
+try {
+ var text = document.createTextNode(" ");
+} catch(e) {}
+try {
+ script.appendChild(text);
+} catch(e) {}
+try {
+ document.documentElement.appendChild(script);
+} catch(e) {}
+try {
+ var selection = getSelection();
+} catch(e) {}
+try {
+ input.select();
+} catch(e) {}
+try {
+ document.replaceChild(document.documentElement, document.documentElement);
+} catch(e) {}
+try {
+ selection.setBaseAndExtent(text, 0, clonedOutput, 0);
+} catch(e) {}
+try {
+ document.designMode = "on";
+} catch(e) {}
+try {
+ document.execCommand("insertImage", false, "http://localhost/");
+} catch(e) {}
+</script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1393171.html b/editor/libeditor/crashtests/1393171.html
new file mode 100644
index 0000000000..0aca3304e7
--- /dev/null
+++ b/editor/libeditor/crashtests/1393171.html
@@ -0,0 +1,10 @@
+<script>
+window.onload=function(){
+ window.getSelection().addRange(document.createRange());
+ document.getElementById('a').appendChild(document.createElement('option'));
+ window.getSelection().modify('extend','backward','lineboundary');
+}
+</script>
+<div></div>
+<textarea autofocus='true'></textarea>
+<del id='a'>
diff --git a/editor/libeditor/crashtests/1402196.html b/editor/libeditor/crashtests/1402196.html
new file mode 100644
index 0000000000..8e0a7be0fe
--- /dev/null
+++ b/editor/libeditor/crashtests/1402196.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // <p> which is the deepest last child of the <body> (<spacer> can contain
+ // <p>).
+ getSelection().collapse(
+ document.querySelector("p"),
+ document.querySelector("p").childNodes.length
+ );
+ document.querySelector("spacer").addEventListener("DOMNodeInserted", () => {
+ document.querySelector("style").appendChild(
+ document.querySelector("table")
+ );
+ document.documentElement.classList.remove("reftest-wait");
+ });
+ document.execCommand("insertOrderedList");
+}
+</script>
+</head>
+<body onload="onLoad()">
+<table></table>
+<style></style>
+<spacer contenteditable>
+<p></p>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1402469.html b/editor/libeditor/crashtests/1402469.html
new file mode 100644
index 0000000000..06583acb8b
--- /dev/null
+++ b/editor/libeditor/crashtests/1402469.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+<script>
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node at end of the <body>.
+ getSelection().collapse(
+ document.body.lastChild,
+ document.body.lastChild.length
+ );
+ document.execCommand("insertUnorderedList");
+}
+</script>
+</head>
+<body onload="onLoad()">
+<table>
+ <th contenteditable>
+ <ol contenteditable>
+ </th>
+</table>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1402526.html b/editor/libeditor/crashtests/1402526.html
new file mode 100644
index 0000000000..fd75a30eca
--- /dev/null
+++ b/editor/libeditor/crashtests/1402526.html
@@ -0,0 +1,24 @@
+<script>
+function onLoad() {
+ const shadow = document.querySelector("shadow");
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // <shadow> which is the deepest last child of the <body>.
+ getSelection().collapse(shadow, shadow.childNodes.length);
+ try {
+ document.querySelector("dd[contenteditable]").addEventListener(
+ "DOMNodeInserted",
+ () => {
+ try {
+ shadow.replaceWith("1");
+ } catch(e) {}
+ }
+ );
+ } catch(e) {}
+ try {
+ document.execCommand("justifyFull");
+ } catch(e) {}
+}
+</script>
+<body onload="onLoad();">
+<dd contenteditable>
+<shadow></body>
diff --git a/editor/libeditor/crashtests/1402904.html b/editor/libeditor/crashtests/1402904.html
new file mode 100644
index 0000000000..544d01208a
--- /dev/null
+++ b/editor/libeditor/crashtests/1402904.html
@@ -0,0 +1,38 @@
+<script>
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // parent of <embed> (<embed> is not a container, therefore, its parent is the
+ // deepest last child container element of the <body>).
+ getSelection().collapse(
+ document.querySelector("embed").parentElement,
+ document.querySelector("embed").parentElement.childNodes.length
+ ); // Point the <embed>
+ const option = document.querySelector("option");
+ option.addEventListener("click", () => {
+ document.execCommand("forwardDelete");
+ });
+ const li2 = document.getElementById("li2");
+ li2.addEventListener("DOMNodeInserted", () => {
+ option.click();
+ });
+ const select = document.querySelector("select");
+ select.parentElement.setAttribute("onpageshow", "onPageShow()");
+}
+
+function onPageShow() {
+ const li1 = document.getElementById("li1");
+ li1.addEventListener("DOMSubtreeModified", () => {
+ document.execCommand("selectAll");
+ document.execCommand("indent");
+ });
+ li1.appendChild(document.createElement("legend"));
+}
+</script>
+<body onload="onLoad()">
+<select>
+<option></option>
+</select>
+<li id="li1"></li>
+<ul contenteditable="true">
+<li id="li2"></li>
+<embed>a;#2
diff --git a/editor/libeditor/crashtests/1405747.html b/editor/libeditor/crashtests/1405747.html
new file mode 100644
index 0000000000..dae3a130f0
--- /dev/null
+++ b/editor/libeditor/crashtests/1405747.html
@@ -0,0 +1,40 @@
+<script>
+let th;
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // <colgroup> which is the last child of the <body>.
+ getSelection().collapse(
+ document.querySelector("colgroup"),
+ document.querySelector("colgroup").childNodes.length
+ );
+ th = document.querySelector("th"); // Cache the target for removing the event handler.
+ try {
+ th.addEventListener("DOMSubtreeModified", onDOMSubtreeModified);
+ } catch(e) {}
+ try {
+ th.align = "";
+ } catch(e) {}
+}
+
+let count = 0;
+function onDOMSubtreeModified() {
+ if (count++ == 1) {
+ // If we didn't stop testing this, this event handler would be called too
+ // many times. It's enough to run twice to reproduce the bug report.
+ th.removeEventListener("DOMSubtreeModified", onDOMSubtreeModified);
+ }
+ try {
+ document.execCommand("selectAll");
+ } catch(e) {}
+ try {
+ document.execCommand("justifyCenter");
+ } catch(e) {}
+ try {
+ document.execCommand("forwardDelete");
+ } catch(e) {}
+}
+</script>
+<body onload="onLoad()">
+<table contenteditable>
+<th></th>
+<colgroup></body>
diff --git a/editor/libeditor/crashtests/1405897.html b/editor/libeditor/crashtests/1405897.html
new file mode 100644
index 0000000000..60118628b5
--- /dev/null
+++ b/editor/libeditor/crashtests/1405897.html
@@ -0,0 +1,23 @@
+<style>
+* { position: absolute; }
+</style>
+<script>
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node in the <iframe> which is the last child of the <body>. Note that
+ // <iframe> is treated as a container in HTMLEditor.
+ const iframe = document.querySelector("iframe");
+ getSelection().collapse(iframe.firstChild, iframe.firstChild.length);
+ document.querySelector("del").addEventListener("DOMSubtreeModified", () => {
+ document.execCommand("italic");
+ document.execCommand("selectAll");
+ });
+ const anchor = document.querySelector("a[contenteditable]");
+ anchor.replaceChild(iframe, anchor.childNodes[0]);
+}
+</script>
+<body onload="onLoad()">
+<a contenteditable>
+<del>
+<iframe>
+</body> \ No newline at end of file
diff --git a/editor/libeditor/crashtests/1408170.html b/editor/libeditor/crashtests/1408170.html
new file mode 100644
index 0000000000..66119e9da3
--- /dev/null
+++ b/editor/libeditor/crashtests/1408170.html
@@ -0,0 +1,40 @@
+<script>
+function onLoad() {
+ try {
+ document.execCommand("insertUnorderedList");
+ } catch(e) {}
+ try {
+ document.execCommand("delete");
+ } catch(e) {}
+}
+
+function onToggle1() {
+ try {
+ getSelection().collapse(
+ document.querySelector("font"),
+ 1
+ );
+ } catch(e) {}
+}
+
+function onToggle2() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node in the <summary> which is the last child of the <body>.
+ const summary = document.querySelector("summary");
+ getSelection().collapse(summary.firstChild, summary.firstChild.length);
+ try {
+ document.querySelector("label").appendChild(
+ document.querySelector("font")
+ );
+ } catch(e) {}
+}
+</script>
+<body onload="onLoad()">
+<label contenteditable>
+<details ontoggle="onToggle2()" open>
+</details>
+</label>
+<details ontoggle="onToggle1()" open>
+<font dir="rtl">
+<summary>
+</details></font></summary></body>
diff --git a/editor/libeditor/crashtests/1414581.html b/editor/libeditor/crashtests/1414581.html
new file mode 100644
index 0000000000..17cdc2f8c8
--- /dev/null
+++ b/editor/libeditor/crashtests/1414581.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function jsfuzzer() {
+ document.execCommand("outdent", false);
+}
+function eventhandler2() {
+ document.execCommand("styleWithCSS", false, true);
+}
+function eventhandler3() {
+ document.execCommand("delete", false);
+ var element1 = document.getElementById("element1");
+ document.getSelection().setPosition(element1, 0);
+ var element1 = document.getElementById("element2");
+ element2.ownerDocument.execCommand("insertOrderedList", false);
+ var element1 = document.getElementById("element3");
+ element3.addEventListener("DOMSubtreeModified", eventhandler3);
+ document.activeElement.setAttribute("contenteditable", "true");
+}
+</script>
+</head>
+<body onload=jsfuzzer()>
+<i id="element1">
+<audio i src="x"></audio>
+<da id="element2">
+<br id="element3" style="">
+<svg onload="eventhandler3()">
+<animate onbegin="eventhandler2()">
+<body>
+</html>
diff --git a/editor/libeditor/crashtests/1415231.html b/editor/libeditor/crashtests/1415231.html
new file mode 100644
index 0000000000..d8702e4542
--- /dev/null
+++ b/editor/libeditor/crashtests/1415231.html
@@ -0,0 +1,26 @@
+<script>
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node in the <option> which is in the last child of the <body>.
+ const option = document.querySelector("option");
+ getSelection().collapse(option.firstChild, option.firstChild.length);
+ document.querySelector("ins").addEventListener(
+ "DOMNodeRemoved",
+ onDOMNodeRemoved
+ );
+ getSelection().setPosition(
+ document.querySelector("shadow")
+ );
+ document.execCommand("insertText", false, "1");
+}
+function onDOMNodeRemoved() {
+ document.execCommand("insertHorizontalRule");
+ document.execCommand("justifyCenter");
+}
+</script>
+<body onload="onLoad()">
+<li contenteditable>
+<shadow>
+<ins>
+<option>
+</li></shadow></ins></option></body>
diff --git a/editor/libeditor/crashtests/1423767.html b/editor/libeditor/crashtests/1423767.html
new file mode 100644
index 0000000000..777cf58036
--- /dev/null
+++ b/editor/libeditor/crashtests/1423767.html
@@ -0,0 +1,17 @@
+<script>
+function onLoad() {
+ const label = document.querySelector("label");
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // <label> which is the last child of the <body>, i.e., at the comment node.
+ getSelection().collapse(label, label.childNodes.length);
+ label.addEventListener("DOMNodeRemoved", () => {
+ document.querySelector("a").innerText = "";
+ });
+ document.execCommand("indent");
+}
+</script>
+<body onload="onLoad()">
+<li contenteditable>
+<a>
+<label></br>
+<!---
diff --git a/editor/libeditor/crashtests/1423776.html b/editor/libeditor/crashtests/1423776.html
new file mode 100644
index 0000000000..4790a79f31
--- /dev/null
+++ b/editor/libeditor/crashtests/1423776.html
@@ -0,0 +1,25 @@
+<script>
+function onLoad() {
+ const svg = document.querySelector("svg");
+ const feConvolveMatrix = document.querySelectorAll("feConvolveMatrix");
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node in the last <svg> which is the deepest last child of the <body>
+ // (i.e., at end of the text node after the last <feConvolveMatrix>).
+ getSelection().collapse(svg.lastChild, svg.lastChild.length);
+ feConvolveMatrix[0].addEventListener("DOMNodeInserted", () => {
+ svg.appendChild(feConvolveMatrix[1]);
+ document.execCommand("insertOrderedList", false);
+ });
+ feConvolveMatrix[0].insertAdjacentHTML(
+ "afterBegin",
+ document.querySelector("table").outerHTML
+ );
+}
+</script>
+<body onload="onLoad()">
+<table></table>
+<b contenteditable>
+<svg>
+<feConvolveMatrix/>
+<feConvolveMatrix/>
+</svg></body>
diff --git a/editor/libeditor/crashtests/1424450.html b/editor/libeditor/crashtests/1424450.html
new file mode 100644
index 0000000000..bd0fd98a42
--- /dev/null
+++ b/editor/libeditor/crashtests/1424450.html
@@ -0,0 +1,51 @@
+<script>
+function onLoad() {
+ const feComponentTransfer = document.querySelector("feComponentTransfer");
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node in the <feComponentTransfer> which is the deepest last child of
+ // the <body>.
+ getSelection().collapse(
+ feComponentTransfer.firstChild,
+ feComponentTransfer.firstChild.length
+ );
+ getSelection().setPosition(
+ document.querySelector("pre[contenteditable]"),
+ 1
+ );
+ getSelection().setBaseAndExtent(
+ document.querySelector("fieldset"),
+ 0,
+ document.querySelector("use"),
+ 0
+ );
+ feComponentTransfer.before(
+ document.querySelector("font-face-uri").previousElementSibling
+ );
+
+ document.execCommand("removeFormat");
+ document.execCommand("hiliteColor", false, "-moz-buttondefault");
+ document.execCommand("insertText", false, "");
+}
+function onBegin() {
+ document.querySelector("desc").appendChild(
+ document.querySelector("fieldset")
+ );
+ document.querySelector("span").appendChild(
+ document.querySelector("a[hidden][contenteditable]")
+ );
+}
+</script>
+<body onload="onLoad()">
+<span>
+<pre contenteditable>
+<fieldset></fieldset>
+<iframe srcdoc="H"></iframe>
+<a hidden contenteditable>
+<svg>
+<set onbegin="onBegin()"/>
+<use>
+<desc></desc>
+</use>
+<font-face-uri/>
+<feComponentTransfer>
+</feComponentTransfer></svg></a></pre></body>
diff --git a/editor/libeditor/crashtests/1425091.html b/editor/libeditor/crashtests/1425091.html
new file mode 100644
index 0000000000..be8f051931
--- /dev/null
+++ b/editor/libeditor/crashtests/1425091.html
@@ -0,0 +1,25 @@
+<script>
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node at end of the <body>, i.e., end of the text node after the
+ // <meter>.
+ getSelection().collapse(
+ document.body.lastChild,
+ document.body.lastChild.length
+ );
+ document.scrollingElement.addEventListener("DOMNodeInserted", () => {
+ document.execCommand("selectAll");
+ document.execCommand("insertOrderedList");
+ });
+ document.querySelector("style").appendChild(
+ document.createElement("e")
+ );
+}
+</script>
+<body onload="onLoad()">
+<meter contenteditable>
+<dialog>
+<style></style>
+</dialog>
+</meter>
+</body>
diff --git a/editor/libeditor/crashtests/1426709.html b/editor/libeditor/crashtests/1426709.html
new file mode 100644
index 0000000000..0026176e98
--- /dev/null
+++ b/editor/libeditor/crashtests/1426709.html
@@ -0,0 +1,27 @@
+<script>
+function onLoad() {
+ const pre = document.querySelector("pre[contenteditable]");
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node at end of the <pre> which is the deepest last child of the
+ // <body>, i.e., end of the text node after the <input>.
+ getSelection().collapse(pre.lastChild, pre.lastChild.length);
+ document.querySelector("li").setAttribute("contenteditable", "true");
+ pre.addEventListener("DOMNodeRemoved", onDOMNodeRemoved);
+ pre.appendChild(
+ document.querySelector("input")
+ );
+}
+function onDOMNodeRemoved() {
+ document.body.appendChild(
+ document.querySelector("pre[contenteditable]")
+ );
+ document.execCommand("justifyFull");
+ document.execCommand("delete");
+}
+</script>
+<body onload="onLoad()">
+<li>
+A
+<pre contenteditable>
+<input autofocus>
+</pre></li></body>
diff --git a/editor/libeditor/crashtests/1429523.html b/editor/libeditor/crashtests/1429523.html
new file mode 100644
index 0000000000..67b227d20b
--- /dev/null
+++ b/editor/libeditor/crashtests/1429523.html
@@ -0,0 +1,18 @@
+<html class="reftest-wait">
+ <head>
+ <script>
+ document.designMode = "on";
+ Promise.all([
+ new Promise(resolve => addEventListener("load", resolve)),
+ new Promise(resolve => addEventListener("focus", resolve)),
+ ]).then(() => {
+ document.body.firstChild.data = "";
+ document.documentElement.removeAttribute("class");
+ });
+ blur();
+ focus();
+ getSelection().collapse(document.body, 0);
+ </script>
+ </head>
+ <body><!-- comment --></body>
+</html>
diff --git a/editor/libeditor/crashtests/1429523.xhtml b/editor/libeditor/crashtests/1429523.xhtml
new file mode 100644
index 0000000000..da2fe16b30
--- /dev/null
+++ b/editor/libeditor/crashtests/1429523.xhtml
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+ <head>
+ <script>
+ document.designMode = "on";
+ Promise.all([
+ new Promise(resolve => addEventListener("load", resolve)),
+ new Promise(resolve => addEventListener("focus", resolve)),
+ ]).then(() => {
+ document.body.firstChild.data = "";
+ document.documentElement.removeAttribute("class");
+ });
+ blur();
+ focus();
+ getSelection().collapse(document.body, 0);
+ </script>
+ </head>
+ <body><![CDATA[ CDATA ]]></body>
+</html>
diff --git a/editor/libeditor/crashtests/1441619.html b/editor/libeditor/crashtests/1441619.html
new file mode 100644
index 0000000000..08343feeed
--- /dev/null
+++ b/editor/libeditor/crashtests/1441619.html
@@ -0,0 +1,12 @@
+<html>
+ <head>
+ <script>
+ try { o1 = window.getSelection() } catch (e) {}
+ try { o2 = document.createRange() } catch (e) {}
+ try { document.head.replaceWith('', document.documentElement) } catch (e) {}
+ try { o1.addRange(o2) } catch (e) {}
+ try { document.designMode = 'on' } catch (e) {}
+ try { o1.focusNode.execCommand('justifyleft', false, null) } catch (e) {}
+ </script>
+ </head>
+</html>
diff --git a/editor/libeditor/crashtests/1443664.html b/editor/libeditor/crashtests/1443664.html
new file mode 100644
index 0000000000..b197d3cd49
--- /dev/null
+++ b/editor/libeditor/crashtests/1443664.html
@@ -0,0 +1,15 @@
+<style>
+input:focus { counter-increment: c; }
+</style>
+<script>
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node at end of the <body>, i.e., end of the text node after the
+ // <input contenteditable>.
+ getSelection().collapse(document.body, document.body.childNodes.length);
+ document.querySelector("input[type=number][contenteditable]").select();
+}
+</script>
+<body onload="onLoad()">
+<input type="number" contenteditable>
+</body>
diff --git a/editor/libeditor/crashtests/1444630.html b/editor/libeditor/crashtests/1444630.html
new file mode 100644
index 0000000000..3bdc490b36
--- /dev/null
+++ b/editor/libeditor/crashtests/1444630.html
@@ -0,0 +1,29 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+function load()
+{
+ let textarea = document.getElementById("editor");
+ textarea.focus();
+
+ const { maybeOnSpellCheck } = SpecialPowers.ChromeUtils.importESModule(
+ "resource://reftest/AsyncSpellCheckTestHelper.sys.mjs"
+ );
+ maybeOnSpellCheck(textarea, () => {
+ let isc = SpecialPowers.wrap(textarea).editor.getInlineSpellChecker(false);
+ let sc = isc.spellChecker;
+
+ textarea.setAttribute("lang", "en-US");
+ sc.UpdateCurrentDictionary(() => {
+ document.documentElement.classList.remove("reftest-wait");
+ });
+ sc.UninitSpellChecker();
+ });
+}
+</script>
+</head>
+<body onload="load()">
+<textarea id="editor" spellchecker="true">ABC</textarea>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1446451.html b/editor/libeditor/crashtests/1446451.html
new file mode 100644
index 0000000000..56c887dc3b
--- /dev/null
+++ b/editor/libeditor/crashtests/1446451.html
@@ -0,0 +1,13 @@
+<script>
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node in the <dialog> which is the deepest last child of the <body>.
+ const dialog = document.querySelector("dialog");
+ getSelection().collapse(dialog.lastChild, dialog.lastChild.length);
+ document.execCommand("insertImage", false, "o")
+}
+</script>
+<body onload="onLoad()">
+<meter contenteditable>
+<dialog>
+</dialog></meter></body>
diff --git a/editor/libeditor/crashtests/1464251.html b/editor/libeditor/crashtests/1464251.html
new file mode 100644
index 0000000000..afe7e87561
--- /dev/null
+++ b/editor/libeditor/crashtests/1464251.html
@@ -0,0 +1,25 @@
+<script>
+var count = 0;
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node in the <s> which is the deepest last child (and a container) of
+ // the <body> (i.e., end of the the text node after the last comment node).
+ const s = document.querySelector("s");
+ getSelection().collapse(s.lastChild, s.lastChild.length);
+ document.execCommand("delete");
+}
+
+function onInputOrDOMNodeInserted() {
+ if (++count >= 3) {
+ return;
+ }
+ addEventListener("DOMNodeInserted", onInputOrDOMNodeInserted);
+ document.execCommand("removeFormat");
+ document.execCommand("insertText", false, "1");
+}
+</script>
+<body onload="onLoad()">
+<ol oninput="onInputOrDOMNodeInserted()" contenteditable>
+<!-- x -->
+<s>
+<!-- x -->
diff --git a/editor/libeditor/crashtests/1470926.html b/editor/libeditor/crashtests/1470926.html
new file mode 100644
index 0000000000..9c39710a97
--- /dev/null
+++ b/editor/libeditor/crashtests/1470926.html
@@ -0,0 +1,9 @@
+<script>
+function go() {
+ a.select();
+ a.setAttribute("hidden", "");
+ a.setRangeText("f");
+}
+</script>
+<body onload=go()>
+<textarea id="a">-</textarea>
diff --git a/editor/libeditor/crashtests/1474978.html b/editor/libeditor/crashtests/1474978.html
new file mode 100644
index 0000000000..d7eb01e03b
--- /dev/null
+++ b/editor/libeditor/crashtests/1474978.html
@@ -0,0 +1,21 @@
+<script>
+function onLoad() {
+ const dd = document.querySelector("dd[contenteditable]");
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node at end of the <dd contenteditable> which is the deepest last
+ // child of the <body> (end of the text node after the <template>).
+ getSelection().collapse(dd.lastChild, dd.lastChild.length);
+ getSelection().setPosition(
+ document.querySelector("template")
+ );
+ dd.addEventListener("DOMNodeInserted", () => {
+ document.execCommand("selectAll");
+ document.execCommand("insertText", false, "");
+ });
+ document.execCommand("insertImage", false, "#");
+}
+</script>
+<body onload="onLoad()">
+<dd contenteditable>
+<template></template>
+</dd></body>
diff --git a/editor/libeditor/crashtests/1517028.html b/editor/libeditor/crashtests/1517028.html
new file mode 100644
index 0000000000..cbc3b71c0a
--- /dev/null
+++ b/editor/libeditor/crashtests/1517028.html
@@ -0,0 +1,23 @@
+<!-- COMMENT -->
+abc
+<head>
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // <em> which is the deepest last child of the <body> (at the comment node).
+ getSelection().collapse(
+ document.querySelector("em[contenteditable]"),
+ document.querySelector("em[contenteditable]").childNodes.length
+ );
+ document.execCommand("justifyLeft");
+ document.designMode = 'on';
+ document.execCommand("insertParagraph");
+});
+</script>
+</head>
+<h4>
+<em contenteditable>
+<big>
+<button autofocus formnovalidate formtarget="">
+</button>
+<!-- COMMENT --></big></em></h4></body>
diff --git a/editor/libeditor/crashtests/1525481.html b/editor/libeditor/crashtests/1525481.html
new file mode 100644
index 0000000000..d96e1c2d0d
--- /dev/null
+++ b/editor/libeditor/crashtests/1525481.html
@@ -0,0 +1,23 @@
+<script>
+function onLoad() {
+ const button = document.querySelector("button");
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // <button> which is the deepest last child of the <body>.
+ getSelection().collapse(button, button.childNodes.length);
+ document.execCommand("styleWithCSS", false, true);
+ document.execCommand("delete");
+ document.querySelector("ul[contenteditable]")
+ .addEventListener("DOMNodeRemoved", () => {
+ const range = document.createRange();
+ range.setEndAfter(button);
+ getSelection().addRange(range);
+ getSelection().deleteFromDocument();
+ });
+ document.execCommand("outdent");
+}
+</script>
+<body onload="onLoad()">
+<ul contenteditable style="margin: -1px 0px 1px 6px">
+<dd></dd>
+<dd>
+<button></button>></dd></ul></body>
diff --git a/editor/libeditor/crashtests/1533913.html b/editor/libeditor/crashtests/1533913.html
new file mode 100644
index 0000000000..3009bbb660
--- /dev/null
+++ b/editor/libeditor/crashtests/1533913.html
@@ -0,0 +1,19 @@
+<script>
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node which is the last child of the <dd contenteditable> which is the
+ // last child of the <body>.
+ const dd = document.querySelector("dd[contenteditable]");
+ getSelection().collapse(dd.lastChild, dd.lastChild.length);
+ document.execCommand("justifyFull");
+ document.execCommand("selectAll");
+ window.top.addEventListener("DOMNodeRemoved", () => {
+ document.execCommand("insertHTML", false, undefined)
+ });
+ document.execCommand("heading", false, "H1")
+}
+</script>
+<body onload="onLoad()">
+<dd contenteditable>A
+<!-- A -->
+</dd></body>
diff --git a/editor/libeditor/crashtests/1534394.html b/editor/libeditor/crashtests/1534394.html
new file mode 100644
index 0000000000..c254aa5f52
--- /dev/null
+++ b/editor/libeditor/crashtests/1534394.html
@@ -0,0 +1,29 @@
+<html>
+<head>
+ <script>
+
+ function start () {
+ const sel = document.getSelection()
+ const range_1 = new Range()
+ const noscript = document.getElementById('id_24')
+ const map = document.getElementById('id_26')
+ sel.selectAllChildren(noscript)
+ const range_2 = range_1.cloneRange()
+ range_2.selectNode(map)
+ const frag = range_2.extractContents()
+ range_2.insertNode(noscript)
+ document.documentElement.contentEditable = true
+ document.execCommand('removeFormat', false,)
+ noscript.contentEditable = false
+ document.execCommand('insertText', false, '�\n')
+ }
+
+ window.addEventListener('load', start)
+ </script>
+</head>
+<body>
+<big class="">
+ <map class="" id="id_26">
+ <noscript class="" id="id_24">
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1547897.html b/editor/libeditor/crashtests/1547897.html
new file mode 100644
index 0000000000..9543048e6c
--- /dev/null
+++ b/editor/libeditor/crashtests/1547897.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<script>
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // last text node of the <body> (end of the text node after the <p hidden>).
+ getSelection().collapse(
+ document.body.lastChild,
+ document.body.lastChild.length
+ );
+ getSelection().setPosition(
+ document.querySelector("hr"),
+ 0
+ );
+ document.execCommand("delete");
+}
+</script>
+<body onload="onLoad()">
+<p hidden>
+ <canvas contenteditable>
+ <hr contenteditable>
+ 3uW4*</hr></canvas>
+</p>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1547898.html b/editor/libeditor/crashtests/1547898.html
new file mode 100644
index 0000000000..696e429e0b
--- /dev/null
+++ b/editor/libeditor/crashtests/1547898.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+ <script>
+ function jsfuzzer () {
+ window.find('1')
+ const selection = window.getSelection()
+ selection.extend(document.getElementById('list_item'))
+ document.getElementById('list_item').contentEditable = 'true'
+ document.execCommand('indent', false)
+ }
+ </script>
+</head>
+<body onload=jsfuzzer()>
+<li id="list_item">16</li>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1556799.html b/editor/libeditor/crashtests/1556799.html
new file mode 100644
index 0000000000..7c213b1f27
--- /dev/null
+++ b/editor/libeditor/crashtests/1556799.html
@@ -0,0 +1,18 @@
+<script>
+function onError() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node in the <dl> which is the last deepest child of the <body>.
+ const dl = document.querySelector("dl");
+ getSelection().collapse(dl.lastChild, dl.lastChild.length);
+ getSelection().selectAllChildren(
+ document.querySelector("img")
+ );
+ document.execCommand("insertUnorderedList");
+ document.execCommand("enableObjectResizing");
+}
+</script>
+<dd contenteditable="true">
+<audio src="data:text/html,foo" onerror="onError()">
+<img></img>
+<dl>
+</dl></audio><dd></body>
diff --git a/editor/libeditor/crashtests/1574544.html b/editor/libeditor/crashtests/1574544.html
new file mode 100644
index 0000000000..26b2fee5ff
--- /dev/null
+++ b/editor/libeditor/crashtests/1574544.html
@@ -0,0 +1,17 @@
+<style>
+* { display: table-caption }
+body { display: contents }
+</style>
+<script>
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node in the <th> which is the deepest last child of the <body>.
+ const th = document.querySelector("th");
+ getSelection().collapse(th.lastChild, th.lastChild.length);
+ document.execCommand("enableInlineTableEditing");
+}
+</script>
+<body onload="onLoad()">
+<table contenteditable>
+<th>
+</th></table></body>
diff --git a/editor/libeditor/crashtests/1578916.html b/editor/libeditor/crashtests/1578916.html
new file mode 100644
index 0000000000..f1d79be804
--- /dev/null
+++ b/editor/libeditor/crashtests/1578916.html
@@ -0,0 +1,28 @@
+<script>
+function onLoad() {
+ const data = document.querySelector("data");
+ const source = document.querySelector("source");
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // <data> which is the deepest last child (and a container) of the <body>.
+ getSelection().collapse(data, data.childNodes.length);
+ source.appendChild(
+ document.body.firstChild // The invisible text node
+ );
+ getSelection().setBaseAndExtent(
+ data.appendChild(source),
+ 0,
+ source,
+ 1
+ );
+ document.querySelector("audio")
+ .addEventListener("DOMCharacterDataModified", () => {
+ getSelection().removeAllRanges()
+ });
+ document.execCommand("delete");
+}
+</script>
+<body onload="onLoad()">
+<audio>
+<li contenteditable>
+<data>
+<source>
diff --git a/editor/libeditor/crashtests/1579934.html b/editor/libeditor/crashtests/1579934.html
new file mode 100644
index 0000000000..55be305e2f
--- /dev/null
+++ b/editor/libeditor/crashtests/1579934.html
@@ -0,0 +1,39 @@
+<html><script>
+window["_gaUserPrefs"] = { ioo : function() { return true; } }
+</script><head>
+<meta charset="windows-1252"><script>
+function onLoad() {
+ const form = document.querySelector("form");
+ form.addEventListener("DOMCharacterDataModified", () => {
+ document.documentElement.appendChild(form);
+ });
+ document.execCommand("delete");
+}
+
+function onToggle() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node node in the <button> which is the deepest last child of the
+ // <body>.
+ const button = document.querySelector("button");
+ getSelection().collapse(button.lastChild, button.lastChild.length);
+ document.querySelector("form").reset();
+}
+</script>
+</head><body onload="onLoad()">
+<details ontoggle="onToggle()" open>
+<dt contenteditable>
+</dt>
+</details><aside style="
+ position: fixed;
+ top: 0px;
+ right: 0px;
+ font-family: &quot;Lucida Console&quot;, monospace;
+ background-color: rgb(242, 230, 217);
+ padding: 3px;
+ z-index: 10000;
+ text-align: center;
+ max-width: 120px;
+ opacity: 0;
+ transition: opacity 0.5s linear 0s;">1194 x 73</aside></body><form id="b"><keygen>
+<button autofocus>
+</button></form></html>
diff --git a/editor/libeditor/crashtests/1581246.html b/editor/libeditor/crashtests/1581246.html
new file mode 100644
index 0000000000..e9c472c7d9
--- /dev/null
+++ b/editor/libeditor/crashtests/1581246.html
@@ -0,0 +1,21 @@
+<script>
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node in the <textarea> which is the last child of the <body>.
+ // However, it may be omitted by the parser. Therefore, this test tries to
+ // check the text node, but if it does not exist, uses the <textarea>.
+ const textarea = document.querySelector("textarea");
+ const textareaOrTextNode = textarea.lastChild ? textarea.lastChild : textarea;
+ getSelection().collapse(textareaOrTextNode, textareaOrTextNode.length);
+ document.querySelector("script").appendChild(
+ document.querySelector("li[contenteditable=false]")
+ );
+ document.execCommand("indent");
+ document.execCommand("delete");
+}
+</script>
+<body onload="onLoad()">
+<ul contenteditable>
+<li contenteditable="false">
+<textarea autofocus>
+</textarea>></li></ul></body>
diff --git a/editor/libeditor/crashtests/1596516.html b/editor/libeditor/crashtests/1596516.html
new file mode 100644
index 0000000000..37b9c5889c
--- /dev/null
+++ b/editor/libeditor/crashtests/1596516.html
@@ -0,0 +1,18 @@
+<html>
+<head>
+ <script>
+ function start () {
+ const italic = document.createElementNS('http://www.w3.org/1999/xhtml', 'i')
+ italic.dir = ''
+ document.documentElement.contentEditable = 'true'
+ const selection = document.getSelection()
+ const range = selection.getRangeAt(0)
+ const attribute = italic.attributes.getNamedItem('dir')
+ range.setEnd(attribute, (2361162229 % attribute.childNodes))
+ document.queryCommandState('heading')
+ }
+
+ document.addEventListener('DOMContentLoaded', start)
+ </script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1605741.html b/editor/libeditor/crashtests/1605741.html
new file mode 100644
index 0000000000..7868adcf96
--- /dev/null
+++ b/editor/libeditor/crashtests/1605741.html
@@ -0,0 +1,14 @@
+<script>
+addEventListener("load", () => {
+ const editingHost = document.querySelector("div[contenteditable]");
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node in the <div contenteditable> which is the last child of the
+ // <body>.
+ getSelection().collapse(editingHost.lastChild, editingHost.lastChild.length);
+ editingHost.addEventListener("DOMNodeRemoved", () => {
+ getSelection().collapse(null);
+ });
+ document.execCommand("delete");
+});
+</script>
+<div contenteditable>x</link></body>
diff --git a/editor/libeditor/crashtests/1613521.html b/editor/libeditor/crashtests/1613521.html
new file mode 100644
index 0000000000..7d59667559
--- /dev/null
+++ b/editor/libeditor/crashtests/1613521.html
@@ -0,0 +1,16 @@
+<script>
+function go() {
+ window.find("1", true, false)
+ a.setAttribute("contenteditable", "true")
+ document.execCommand("forwardDelete", false)
+ document.execCommand("enableObjectResizing", false)
+}
+</script>
+<dl id="a">
+<table>
+<th>
+GjdR1W3
+<svg>
+<animateMotion onbegin="go()" />
+</tr>
+<details ontoggle="go()" open>
diff --git a/editor/libeditor/crashtests/1618906.html b/editor/libeditor/crashtests/1618906.html
new file mode 100644
index 0000000000..cdb278f018
--- /dev/null
+++ b/editor/libeditor/crashtests/1618906.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+ <script>
+ window.addEventListener('load', () => {
+ const range = new Range()
+ const fragment = range.cloneContents()
+ range.selectNodeContents(document)
+ document.designMode = 'on'
+ document.replaceChild(fragment, document.documentElement)
+ const selection = window.getSelection()
+ selection.addRange(range)
+ document.execCommand('indent', false, null)
+ })
+ </script>
+</head>
+</html>
+<!-- COMMENT -->
diff --git a/editor/libeditor/crashtests/1623166.html b/editor/libeditor/crashtests/1623166.html
new file mode 100644
index 0000000000..75bbb20872
--- /dev/null
+++ b/editor/libeditor/crashtests/1623166.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+ const code = document.querySelector("code[contenteditable=false]");
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // last text node in the <code> which is the last inline container of the
+ // <body>.
+ getSelection().collapse(code.lastChild, code.lastChild.length);
+ code.querySelector("br").contentEditable = true;
+ document.execCommand("indent");
+});
+</script>
+<body>
+<b contenteditable hidden>
+ <script></script>
+ <code contenteditable="false">
+ <br>
+</body>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1623913.html b/editor/libeditor/crashtests/1623913.html
new file mode 100644
index 0000000000..291bd65197
--- /dev/null
+++ b/editor/libeditor/crashtests/1623913.html
@@ -0,0 +1,30 @@
+<html>
+<head>
+ <script>
+ async function start () {
+ const element_0 = document.createElementNS('', 's')
+ const svg = document.getElementById('id_8')
+ const math = document.getElementById('id_20')
+ const selection = window.getSelection()
+ const range = new Range()
+ range.setStartAfter(math)
+ range.insertNode(svg)
+ range.selectNodeContents(element_0)
+ document.documentElement.contentEditable = true
+ range.setStart(svg, (2760506212 % svg.childNodes))
+ selection.addRange(range)
+ document.execCommand('insertOrderedList', false, null)
+ document.execCommand('insertParagraph', false, null)
+ }
+
+ document.addEventListener('DOMContentLoaded', start)
+ </script>
+</head>
+<body>
+<svg id='id_8'>
+ <metadata xml:space='preserve'>
+</svg>
+<math id='id_20'>
+</math>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1624005.html b/editor/libeditor/crashtests/1624005.html
new file mode 100644
index 0000000000..9d277db6ed
--- /dev/null
+++ b/editor/libeditor/crashtests/1624005.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+ <script>
+ window.addEventListener('load', () => {
+ const element = document.createElementNS('', 't')
+ document.designMode = 'on'
+ const range = new Range()
+ range.selectNodeContents(element)
+ range.surroundContents(document.documentElement)
+ document.execCommand('insertHorizontalRule', false, null)
+ })
+ </script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1624007.html b/editor/libeditor/crashtests/1624007.html
new file mode 100644
index 0000000000..06e35e1d50
--- /dev/null
+++ b/editor/libeditor/crashtests/1624007.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+ <script>
+ window.addEventListener('load', () => {
+ const element = document.createElement('t')
+ document.documentElement.appendChild(element)
+ document.documentElement.contentEditable = true
+ const selection = self.getSelection()
+ const range_1 = new Range()
+ range_1.setStart(element, (1715865858 % element.childNodes))
+ document.execCommand('enableObjectResizing', false, true)
+ const range_2 = new Range()
+ selection.addRange(range_2)
+ selection.addRange(range_1)
+ document.execCommand('bold', false, null)
+ })
+ </script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1624011.html b/editor/libeditor/crashtests/1624011.html
new file mode 100644
index 0000000000..98267f848d
--- /dev/null
+++ b/editor/libeditor/crashtests/1624011.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+ <script>
+ window.addEventListener('load', () => {
+ document.designMode = 'on'
+ const selection = document.getSelection()
+ selection.empty()
+ document.queryCommandIndeterm('justifyFull')
+ })
+ </script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1626002.html b/editor/libeditor/crashtests/1626002.html
new file mode 100644
index 0000000000..55099cb648
--- /dev/null
+++ b/editor/libeditor/crashtests/1626002.html
@@ -0,0 +1,27 @@
+<html>
+<head>
+<script>
+addEventListener("load", () => {
+ const anchor = document.createElement("a");
+ const b = document.createElement("b");
+ const c = document.createElement("c");
+ document.documentElement.appendChild(anchor);
+ anchor.appendChild(b);
+ b.setAttribute("contenteditable", "true");
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // <body> which must be empty because this test appends the new elements after
+ // the <body>.
+ const selection = self.getSelection();
+ selection.collapse(document.body, document.body.childNodes.length);
+ b.appendChild(c);
+ c.outerHTML = '<s contenteditable="false"><b contenteditable="true">';
+ selection.setBaseAndExtent(document, 0, document.documentElement, 0);
+ const range = selection.getRangeAt((260523900 % selection.rangeCount));
+ selection.selectAllChildren(b);
+ range.collapse(false);
+ range.setEndAfter(document.documentElement);
+ range.extractContents();
+});
+</script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1636541.html b/editor/libeditor/crashtests/1636541.html
new file mode 100644
index 0000000000..71a92817d8
--- /dev/null
+++ b/editor/libeditor/crashtests/1636541.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+ <script>
+ window.addEventListener('load', () => {
+ document.documentElement.contentEditable = true
+ document.execCommand('indent', false, null)
+ const selection = document.getSelection()
+ selection.collapse(document.documentElement, (3474956128 % document.documentElement.childNodes))
+ document.execCommand('indent', false, null)
+ document.execCommand('outdent', false, null)
+ })
+ </script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1644903.html b/editor/libeditor/crashtests/1644903.html
new file mode 100644
index 0000000000..175c6afda7
--- /dev/null
+++ b/editor/libeditor/crashtests/1644903.html
@@ -0,0 +1,19 @@
+<script>
+window.onload = () => {
+ document.execCommand("undo");
+}
+function onToggle() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node at end of the <details> (<p> is closed before the <details>).
+ const details = document.querySelector("details");
+ getSelection().collapse(details.lastChild, details.lastChild.length);
+ const link = document.querySelector("link");
+ document.execCommand("delete");
+ document.querySelector("iframe").contentDocument.adoptNode(link);
+}
+</script>
+<p contenteditable>
+<link item="">
+<details open ontoggle="onToggle()">
+<iframe></iframe>
+</details></body>
diff --git a/editor/libeditor/crashtests/1645983-1.html b/editor/libeditor/crashtests/1645983-1.html
new file mode 100644
index 0000000000..c1bb7219a5
--- /dev/null
+++ b/editor/libeditor/crashtests/1645983-1.html
@@ -0,0 +1,11 @@
+<div contenteditable>&nbsp;a</div>
+<script>
+// For emulating the traditional behavior, collapse Selection to end of the
+// text node in this <script>.
+const script = document.querySelector("script");
+getSelection().collapse(script.lastChild, script.lastChild.length);
+const editingHost = document.querySelector("div[contenteditable]");
+editingHost.insertBefore(document.createTextNode(""), editingHost.firstChild);
+getSelection().collapse(editingHost.firstChild.nextSibling, 2);
+document.execCommand("delete");
+</script></body>
diff --git a/editor/libeditor/crashtests/1645983-2.html b/editor/libeditor/crashtests/1645983-2.html
new file mode 100644
index 0000000000..132c1381f3
--- /dev/null
+++ b/editor/libeditor/crashtests/1645983-2.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<div contenteditable>abc<span></span><span></span></div>
+<script>
+// For emulating the traditional behavior, collapse Selection to end of the
+// text node after this <script>.
+getSelection().collapse(
+ document.body.lastChild,
+ document.body.lastChild.length
+);
+const editingHost = document.querySelector("div[contenteditable]");
+getSelection().collapse(editingHost, 3);
+document.execCommand("insertText", false, " ");
+</script>
+</body>
diff --git a/editor/libeditor/crashtests/1648564.html b/editor/libeditor/crashtests/1648564.html
new file mode 100644
index 0000000000..f82ec3d8e6
--- /dev/null
+++ b/editor/libeditor/crashtests/1648564.html
@@ -0,0 +1,29 @@
+<script>
+window.addEventListener('load', () => {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // <body> (at the comment node).
+ getSelection().collapse(document.body, document.body.childNodes.length);
+ const map = document.querySelector("map");
+ const anchor = document.querySelector("a");
+ map.replaceChild(
+ anchor,
+ map.childNodes[(2828994049 % map.childNodes.length)]
+ );
+ anchor.innerHTML = "<o>";
+ getSelection().setBaseAndExtent(
+ document,
+ (2019424593 % document.childNodes.length),
+ document.documentElement,
+ (3503355750 % document.documentElement.childNodes.length)
+ );
+ document.designMode = "on";
+ document.execCommand("forwardDelete");
+ document.execCommand("forwardDelete");
+});
+</script>
+<sub contenteditable>
+<map>
+<address></address>
+<a>
+</a>
+<!-- COMMENT --></body>
diff --git a/editor/libeditor/crashtests/1655508.html b/editor/libeditor/crashtests/1655508.html
new file mode 100644
index 0000000000..e30aba0ca0
--- /dev/null
+++ b/editor/libeditor/crashtests/1655508.html
@@ -0,0 +1,34 @@
+<html>
+<head>
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node at end of the <body> (end of the text node after the <h3>).
+ getSelection().collapse(
+ document.body.lastChild,
+ document.body.lastChild.length
+ );
+ const textarea = document.querySelector("textarea");
+ const abbr = document.querySelector("abbr");
+ let node;
+ document.addEventListener("DOMAttrModified", event => {
+ node = event.originalTarget.getRootNode({});
+ abbr.insertBefore(textarea, abbr.childNodes[0]);
+ }, false);
+ abbr.contentEditable = false;
+ node.normalize();
+ document.designMode = "on";
+ document.execCommand("insertParagraph");
+});
+</script>
+</head>
+<body>
+<dfn contenteditable>
+ <abbr></abbr>
+</dfn>
+<h3>
+ <textarea autofocus></textarea>
+ <script></script>
+</h3>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1655539.html b/editor/libeditor/crashtests/1655539.html
new file mode 100644
index 0000000000..094c7b2e30
--- /dev/null
+++ b/editor/libeditor/crashtests/1655539.html
@@ -0,0 +1,15 @@
+<script>
+ document.addEventListener('DOMContentLoaded', () => {
+ selection = document.getSelection()
+ element = document.createElementNS('', 'm')
+ document.documentElement.appendChild(element)
+ range = new Range()
+ range.setStartBefore(element)
+ selection.addRange(range)
+ document.documentElement.contentEditable = true
+ document.execCommand('forwardDelete', false, null)
+ })
+</script>
+<iframe class='\'>'>
+</iframe>
+<!-- COMMENT --> \ No newline at end of file
diff --git a/editor/libeditor/crashtests/1655988.html b/editor/libeditor/crashtests/1655988.html
new file mode 100644
index 0000000000..666a5f8cb8
--- /dev/null
+++ b/editor/libeditor/crashtests/1655988.html
@@ -0,0 +1,29 @@
+<html>
+<head>
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node at end of the <body> (end of the text node after the
+ // <feDistantLight>).
+ getSelection().collapse(
+ document.body.lastChild,
+ document.body.lastChild.length
+ );
+ const feDistantLight = document.querySelector("feDistantLight");
+ const li = document.querySelector("li");
+ li.after('foo');
+ feDistantLight.addEventListener("DOMAttrModified", () => {
+ window.find("foo");
+ document.execCommand("insertImage", false, "#");
+ })
+ feDistantLight.setAttribute("i", "");
+});
+</script>
+</head>
+<body>
+<feDistantLight contenteditable>
+ <li>A</li>
+ <!-- COMMENT -->
+</feDistantLight>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1659717.html b/editor/libeditor/crashtests/1659717.html
new file mode 100644
index 0000000000..a3e9c59699
--- /dev/null
+++ b/editor/libeditor/crashtests/1659717.html
@@ -0,0 +1,14 @@
+<html><script type="text/javascript" id="__gaOptOutExtension">window["_gaUserPrefs"] = { ioo : function() { return true; } }</script><head>
+<meta http-equiv="content-type" content="text/html; charset=windows-1252">
+ <script>
+ document.addEventListener('DOMContentLoaded', async () => {
+ const selection = document.getSelection()
+ document.designMode = 'on'
+ selection.collapse(document, 0)
+ document.execCommand('forwardDelete', false, null)
+ })
+ </script>
+</head>
+<body>
+<aside style="position:fixed;top:0px;right:0px;font-family:&quot;Lucida Console&quot;,monospace;background-color:#f2e6d9;padding:3px;z-index:10000;text-align:center;max-width:120px;opacity:0;transition:opacity linear;"></aside></body></html>
+<!-- COMMENT --> \ No newline at end of file
diff --git a/editor/libeditor/crashtests/1663725.html b/editor/libeditor/crashtests/1663725.html
new file mode 100644
index 0000000000..7f4ffd62eb
--- /dev/null
+++ b/editor/libeditor/crashtests/1663725.html
@@ -0,0 +1,18 @@
+<script>
+window.onload = () => {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // <body> (at the text node after the <input>).
+ getSelection().collapse(document.body, document.body.childNodes.length);
+ document.execCommand("insertHorizontalRule");
+ getSelection().collapse(
+ document.querySelector("b")
+ );
+ document.execCommand("forwardDelete");
+}
+function onFocusChangeOfInput() {
+ document.getSelection().setPosition(document.querySelector("pre"));
+}
+</script>
+<pre>
+<time contenteditable>a|</t>
+<input onfocus="onFocusChangeOfInput()" autofocus onblur="onFocusChangeOfInput()">
diff --git a/editor/libeditor/crashtests/1666556.html b/editor/libeditor/crashtests/1666556.html
new file mode 100644
index 0000000000..8c8c18574a
--- /dev/null
+++ b/editor/libeditor/crashtests/1666556.html
@@ -0,0 +1,28 @@
+<script>
+function onError() {
+ document.querySelector("details").appendChild(
+ document.querySelector("p")
+ );
+ document.execCommand("indent");
+}
+
+function onLoadOfStyle() {
+ document.execCommand("delete");
+ document.querySelector("details").contentEditable = "true";
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node at end of the <style> (end of the text node after the comment
+ // node).
+ const style = document.querySelector("style");
+ getSelection().collapse(style.lastChild, style.lastChild.length);
+ document.querySelector("input").select();
+}
+</script>
+<video focus="false">
+<source onerror="onError()">
+</video>
+<details open>
+<p>
+<input contenteditable="false">
+<style onload="onLoadOfStyle()">
+<!-- x -->
+</style></p></details></body>
diff --git a/editor/libeditor/crashtests/1677566.html b/editor/libeditor/crashtests/1677566.html
new file mode 100644
index 0000000000..1546bb4601
--- /dev/null
+++ b/editor/libeditor/crashtests/1677566.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+ const table = document.querySelector("table");
+ // For emulating traditional behavior, collapse Selection to end of the
+ // text node after the <p> (<table> does not close the <p>).
+ getSelection().collapse(
+ document.body.lastChild,
+ document.body.lastChild.length
+ );
+ const paragraph = document.querySelector("p");
+ document.documentElement.contentEditable = true;
+ getSelection().setBaseAndExtent(document, 0, document.documentElement, 1);
+ paragraph.contentEditable = false;
+ table.insertRow(0);
+ document.execCommand("forwardDelete");
+});
+</script>
+</head>
+<p>
+ <del>
+ <button contenteditable>
+ </button>
+ <table>
+ </table>
+ </del>
+</p>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1691051.html b/editor/libeditor/crashtests/1691051.html
new file mode 100644
index 0000000000..29aeae551c
--- /dev/null
+++ b/editor/libeditor/crashtests/1691051.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ window.addEventListener('load', () => {
+ document.documentElement.contentEditable = true
+ document.execCommand('selectAll', false, null)
+ document.addEventListener('DOMNodeRemoved', async (e) => {
+ e.currentTarget.writeln()
+ }, {})
+ document.execCommand('insertLineBreak', false, null)
+ })
+ </script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1699866.html b/editor/libeditor/crashtests/1699866.html
new file mode 100644
index 0000000000..f8d700ec9c
--- /dev/null
+++ b/editor/libeditor/crashtests/1699866.html
@@ -0,0 +1,22 @@
+<script>
+window.onload = () => {
+ const font = document.querySelector("font");
+ // For emulating traditional behavior, collapse Selection to end of the
+ // text node in the <font>.
+ getSelection().collapse(font.lastChild, font.lastChild.length);
+ const meta = document.querySelector("meta");
+ meta.style.setProperty(
+ "text-decoration",
+ "overline underline line-through"
+ );
+ meta.appendChild(font);
+ document.execCommand("selectAll");
+ getSelection().extend(meta, 0);
+ document.execCommand("underline");
+}
+</script>
+<ins contenteditable>
+a
+<meta></meta>
+<font>
+</font></ins></body>
diff --git a/editor/libeditor/crashtests/1701348.html b/editor/libeditor/crashtests/1701348.html
new file mode 100644
index 0000000000..1e8c2fbaa7
--- /dev/null
+++ b/editor/libeditor/crashtests/1701348.html
@@ -0,0 +1,10 @@
+<style>
+.c { resize: both }
+</style>
+<script>
+window.onload = () => {
+ a.className = "a"
+ document.execCommand("delete", false)
+}
+</script>
+<input id="a" autofocus="autofocus" class="c">
diff --git a/editor/libeditor/crashtests/1707630.html b/editor/libeditor/crashtests/1707630.html
new file mode 100644
index 0000000000..e62df20b1b
--- /dev/null
+++ b/editor/libeditor/crashtests/1707630.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ window.addEventListener('load', () => {
+ document = document
+ document.documentElement = document.documentElement
+ document.addEventListener('DOMNodeInserted', (e) => {
+ e.currentTarget.removeChild(e.currentTarget.childNodes[(2731378636 % e.currentTarget.childNodes.length)])
+ }, {})
+ document.documentElement.contentEditable = true
+ document.execCommand('insertParagraph', false, null)
+ })
+ </script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/336081-1.xhtml b/editor/libeditor/crashtests/336081-1.xhtml
new file mode 100644
index 0000000000..5a499d9f51
--- /dev/null
+++ b/editor/libeditor/crashtests/336081-1.xhtml
@@ -0,0 +1,52 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+<![CDATA[
+
+function foop(targetWindow)
+{
+ var targetDocument = targetWindow.document;
+
+ var r1 = targetDocument.createRange();
+ r1.setStart(targetDocument.getElementById("out1"), 0);
+ r1.setEnd (targetDocument.getElementById("out2"), 0);
+ targetWindow.getSelection().addRange(r1);
+
+ var r2 = targetDocument.createRange();
+ r2.setStart(targetDocument.getElementById("in1"), 0);
+ r2.setEnd (targetDocument.getElementById("in2"), 0);
+ targetWindow.getSelection().addRange(r2);
+
+ targetDocument.execCommand('removeformat', false, null);
+ targetDocument.execCommand('outdent', false, null);
+}
+
+function init()
+{
+ setTimeout(function()
+ {
+ var fd = window.frames[0].document;
+ fd.body.appendChild(fd.importNode(document.getElementById('rootish'), true));
+ fd.designMode = 'on';
+ foop(window.frames[0]);
+ document.documentElement.removeAttribute("class");
+ }, 100);
+}
+
+]]>
+</script>
+</head>
+
+<body onload="init()">
+
+<iframe srcdoc="<html></html>" style="width: 95%; height: 500px;"/>
+
+<div id="rootish">
+<div id="out1"/>
+<div id="in1"/>
+<div id="in2"/>
+<div id="out2"/>
+</div>
+
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/403965-1.xhtml b/editor/libeditor/crashtests/403965-1.xhtml
new file mode 100644
index 0000000000..02993914d9
--- /dev/null
+++ b/editor/libeditor/crashtests/403965-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<tbody contenteditable="true"/>
+<frameset/>
+<xul:box onbeforecopy="event.explicitOriginalTarget.parentNode.parentNode.removeChild(event.explicitOriginalTarget.parentNode)">
+<xul:box/>
+</xul:box>
+</html> \ No newline at end of file
diff --git a/editor/libeditor/crashtests/428489-1.html b/editor/libeditor/crashtests/428489-1.html
new file mode 100644
index 0000000000..8eec1268b9
--- /dev/null
+++ b/editor/libeditor/crashtests/428489-1.html
@@ -0,0 +1,8 @@
+<html>
+<head>
+<title>Crash [@ nsHTMLEditor::GetPositionAndDimensions] when window gets removed during click on contenteditable absolute positioned element</title>
+</head>
+<body>
+<iframe id="content" src="data:text/html;charset=utf-8,%3Chtml%3E%3Chead%3E%0A%3Cscript%3E%0Awindow.addEventListener%28%27DOMAttrModified%27%2C%20function%28e%29%20%7Bdump%28%27DOMAttrModified\n%27%29%3Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%3B%7D%2C%20true%29%3B%0A%3C/script%3E%0A%3C/head%3E%0A%3Cbody%3E%0A%3Cdiv%20style%3D%22position%3A%20absolute%3B%22%20contenteditable%3D%22true%22%3EClicking%20on%20this%20should%20not%20crash%20Mozilla%0A%3C/body%3E%0A%3C/html%3E" style="width:1000px;height: 300px;"></iframe>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/429586-1.html b/editor/libeditor/crashtests/429586-1.html
new file mode 100644
index 0000000000..a32df3b721
--- /dev/null
+++ b/editor/libeditor/crashtests/429586-1.html
@@ -0,0 +1,8 @@
+<html>
+<head>
+<title>Bug 429586 - Crash [@ nsEditor::EndUpdateViewBatch] with pasting and domattrmodified removing iframe</title>
+</head>
+<body>
+<iframe id="content" src="data:text/html;charset=utf-8,%3Chtml%3E%0A%3Chead%3E%0A%3C/head%3E%0A%3Cbody%20contenteditable%3D%22true%22%3E%0A%0A%3Cscript%3E%0Afunction%20dokey%28%29%7B%0Adocument.body.focus%28%29%3B%0Adocument.execCommand%28%27insertParagraph%27%2C%20false%2C%20%27%27%29%3B%0A%7D%0AsetTimeout%28dokey%2C200%29%3B%0A%0Adocument.addEventListener%28%27DOMAttrModified%27%2C%20function%28%29%20%7Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%7D%2C%20true%29%3B%0A%3C/script%3E%0A%3C/body%3E%0A%3C/html%3E"></iframe>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/431086-1.xhtml b/editor/libeditor/crashtests/431086-1.xhtml
new file mode 100644
index 0000000000..c6c5d8d992
--- /dev/null
+++ b/editor/libeditor/crashtests/431086-1.xhtml
@@ -0,0 +1,22 @@
+<div xmlns="http://www.w3.org/1999/xhtml">
+
+<script type="text/javascript">
+
+function boom()
+{
+ var r = document.documentElement;
+ r.style.position = "absolute";
+ r.contentEditable = "true";
+ r.focus();
+ r.contentEditable = "false";
+ r.focus();
+ r.contentEditable = "true";
+ document.execCommand("subscript", false, null);
+ r.contentEditable = "false";
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+
+</div>
diff --git a/editor/libeditor/crashtests/475132-1.xhtml b/editor/libeditor/crashtests/475132-1.xhtml
new file mode 100644
index 0000000000..e721c55639
--- /dev/null
+++ b/editor/libeditor/crashtests/475132-1.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+function onLoad() {
+ document.querySelector("td").contentEditable = "true";
+ getSelection().collapse(
+ document.querySelector("td"),
+ document.querySelector("td").childNodes.length
+ );
+ document.querySelector("td").focus();
+ document.documentElement.contentEditable = "true";
+ document.documentElement.focus();
+ document.execCommand("indent");
+ document.execCommand("insertParagraph");
+}
+</script>
+</head>
+
+<body onload="onLoad();" contenteditable="false"><td></td></body>
+
+</html>
diff --git a/editor/libeditor/crashtests/503709-1.xhtml b/editor/libeditor/crashtests/503709-1.xhtml
new file mode 100644
index 0000000000..867bebf1a9
--- /dev/null
+++ b/editor/libeditor/crashtests/503709-1.xhtml
@@ -0,0 +1,11 @@
+<html contenteditable="true" xmlns="http://www.w3.org/1999/xhtml"><head><script>
+
+function boom()
+{
+ document.execCommand("selectAll", false, "");
+ try { document.execCommand("justifyfull", false, null); } catch(e) { }
+ try { document.execCommand("inserthorizontalrule", false, "false"); } catch(e) { }
+ document.execCommand("delete", false, null);
+}
+
+</script></head>x y z<body onload="boom();"><div/></body></html>
diff --git a/editor/libeditor/crashtests/513375-1.xhtml b/editor/libeditor/crashtests/513375-1.xhtml
new file mode 100644
index 0000000000..4db5a42159
--- /dev/null
+++ b/editor/libeditor/crashtests/513375-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head contenteditable="true">
+<script type="text/javascript">
+<![CDATA[
+function onLoad() {
+ getSelection().collapse(document.body, document.body.childNodes.length);
+ const r = document.createRange();
+ r.selectNode(document.body);
+ r.deleteContents();
+ try {
+ document.execCommand("selectAll");
+ } catch(e) {}
+}
+]]>
+</script>
+</head>
+
+<body onload="onLoad();" contenteditable="true"></body>
+</html>
diff --git a/editor/libeditor/crashtests/535632-1.xhtml b/editor/libeditor/crashtests/535632-1.xhtml
new file mode 100644
index 0000000000..92470b8258
--- /dev/null
+++ b/editor/libeditor/crashtests/535632-1.xhtml
@@ -0,0 +1 @@
+<body xmlns="http://www.w3.org/1999/xhtml" style="margin: 200px;" contenteditable="true" onload="document.execCommand('outdent', false, null);" /> \ No newline at end of file
diff --git a/editor/libeditor/crashtests/574558-1.xhtml b/editor/libeditor/crashtests/574558-1.xhtml
new file mode 100644
index 0000000000..4e61ad02e7
--- /dev/null
+++ b/editor/libeditor/crashtests/574558-1.xhtml
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><head><script>
+<![CDATA[
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node in the <textarea> which is the deepest last child of the <body>.
+ const textarea = document.querySelector("textarea");
+ getSelection().collapse(textarea.lastChild, textarea.lastChild.length);
+ document.execCommand("selectAll");
+ document.execCommand("selectAll");
+ document.execCommand("inserthtml", false, "<span><div>");
+ const span = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+ textarea.appendChild(span);
+}
+]]>
+</script></head><div contenteditable="true"></div><body onload="onLoad();"><textarea>f</textarea></body></html>
diff --git a/editor/libeditor/crashtests/580151-1.xhtml b/editor/libeditor/crashtests/580151-1.xhtml
new file mode 100644
index 0000000000..3799411117
--- /dev/null
+++ b/editor/libeditor/crashtests/580151-1.xhtml
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+var t;
+
+function boom()
+{
+ var b = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+ t = document.createElementNS("http://www.w3.org/1999/xhtml", "textarea");
+ b.appendChild(t);
+ document.removeChild(document.documentElement)
+ document.appendChild(b)
+ document.removeChild(document.documentElement)
+ var ns = document.createElementNS("http://www.w3.org/1999/xhtml", "script");
+ var nt = document.createTextNode("t.appendChild(document.createTextNode(' '));");
+ ns.appendChild(nt);
+ b.appendChild(ns);
+ document.appendChild(b);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/582138-1.xhtml b/editor/libeditor/crashtests/582138-1.xhtml
new file mode 100644
index 0000000000..afcec2eba1
--- /dev/null
+++ b/editor/libeditor/crashtests/582138-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><mtr xmlns="http://www.w3.org/1998/Math/MathML"><td id="cell" xmlns="http://www.w3.org/1999/xhtml"></td></mtr><script>
+function boom()
+{
+ document.getElementById("cell").contentEditable = true;
+ document.getElementById("cell").focus();
+ document.execCommand("inserthtml", false, "x");
+}
+
+window.addEventListener("load", boom, false);
+</script></html>
diff --git a/editor/libeditor/crashtests/633709.xhtml b/editor/libeditor/crashtests/633709.xhtml
new file mode 100644
index 0000000000..75ad518b8f
--- /dev/null
+++ b/editor/libeditor/crashtests/633709.xhtml
@@ -0,0 +1,68 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<body><div contenteditable="true"></div><div><input><div></div></input></div></body>
+
+<script>
+<![CDATA[
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // parent <div> of the <input>. In XHTML document, the <input> may have the
+ // <div> child. Therefore, the deepest last child container element of the
+ // <body> is the parent of the <input>.
+ getSelection().collapse(
+ document.querySelector("input").parentElement,
+ document.querySelector("input").parentElement.childNodes.length
+ );
+ document.querySelector("input").focus();
+
+ try {
+ document.execCommand("stylewithcss", false, "true");
+ } catch(e) {}
+ try {
+ document.execCommand("inserthtml", false, "<x>X</x>");
+ } catch(e) {}
+ try {
+ document.execCommand("underline");
+ } catch(e) {}
+ try {
+ document.execCommand("justifyfull");
+ } catch(e) {}
+ try {
+ document.execCommand("underline");
+ } catch(e) {}
+ try {
+ document.execCommand("insertParagraph");
+ } catch(e) {}
+ try {
+ document.execCommand("delete");
+ } catch(e) {}
+
+ try {
+ document.execCommand("stylewithcss", false, "false");
+ } catch(e) {}
+ try {
+ document.execCommand("inserthtml", false, "<x>X</x>");
+ } catch(e) {}
+ try {
+ document.execCommand("underline");
+ } catch(e) {}
+ try {
+ document.execCommand("justifyfull");
+ } catch(e) {}
+ try {
+ document.execCommand("underline");
+ } catch(e) {}
+ try {
+ document.execCommand("insertParagraph");
+ } catch(e) {}
+ try {
+ document.execCommand("delete");
+ } catch(e) {}
+
+ document.documentElement.removeAttribute("class");
+}
+addEventListener("load", onLoad);
+]]>
+</script>
+
+</html>
diff --git a/editor/libeditor/crashtests/639736-1.xhtml b/editor/libeditor/crashtests/639736-1.xhtml
new file mode 100644
index 0000000000..1aea3040e0
--- /dev/null
+++ b/editor/libeditor/crashtests/639736-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // <td> which is the deepest last child of the <body>.
+ getSelection().collapse(
+ document.querySelector("td"),
+ document.querySelector("td").childNodes.length
+ );
+ try {
+ document.execCommand("removeformat");
+ } catch(e) {}
+ document.adoptNode(document.documentElement);
+}
+</script>
+</head>
+<body onload="onLoad();"><td contenteditable="true"/></body>
+</html>
diff --git a/editor/libeditor/crashtests/713427-2.xhtml b/editor/libeditor/crashtests/713427-2.xhtml
new file mode 100644
index 0000000000..39ac18ed07
--- /dev/null
+++ b/editor/libeditor/crashtests/713427-2.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boom()
+{
+ while (document.documentElement.firstChild) {
+ document.documentElement.firstChild.remove();
+ }
+
+ var td = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
+ td.setAttributeNS(null, "contenteditable", "true");
+ (document.documentElement).appendChild(td);
+ var head = document.createElementNS("http://www.w3.org/1999/xhtml", "head");
+ (document.documentElement).appendChild(head);
+
+ head.appendChild(td);
+}
+
+window.addEventListener("load", boom);
+
+]]>
+</script>
+</head>
+
+<body></body>
+</html>
diff --git a/editor/libeditor/crashtests/766360.html b/editor/libeditor/crashtests/766360.html
new file mode 100644
index 0000000000..76c30456d6
--- /dev/null
+++ b/editor/libeditor/crashtests/766360.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var r = document.createRange();
+ r.setEnd(document.createTextNode("x"), 0);
+ window.getSelection().addRange(r);
+ document.execCommand("inserthtml", false, "y");
+}
+
+</script>
+</head>
+
+<body contenteditable="true" onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/766387.html b/editor/libeditor/crashtests/766387.html
new file mode 100644
index 0000000000..a819bf7f89
--- /dev/null
+++ b/editor/libeditor/crashtests/766387.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function onLoad() {
+ const editingHost = document.querySelectorAll("div[contenteditable]");
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // last <div contenteditable> which is the deepest last child of the <body>.
+ getSelection().collapse(editingHost[1], editingHost[1].childNodes.length);
+ getSelection().removeAllRanges();
+ const r = document.createRange();
+ r.setStart(editingHost[0], 1);
+ r.setEnd(editingHost[1], 0);
+ getSelection().addRange(r);
+ document.execCommand("insertOrderedList");
+}
+</script>
+</head>
+
+<body onload="onLoad();"><div contenteditable>a</div><div contenteditable></div></body>
+</html>
diff --git a/editor/libeditor/crashtests/766413.html b/editor/libeditor/crashtests/766413.html
new file mode 100644
index 0000000000..1a7092d92a
--- /dev/null
+++ b/editor/libeditor/crashtests/766413.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var root = document.documentElement;
+ while (root.firstChild) {
+ root.firstChild.remove();
+ }
+
+ var space = document.createTextNode(" ");
+ var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+ root.contentEditable = "true";
+ root.focus();
+ document.execCommand("contentReadOnly", false, null);
+ root.appendChild(body);
+ root.contentEditable = "false";
+ root.appendChild(space);
+ root.removeChild(body);
+ root.contentEditable = "true";
+
+ window.getSelection().removeAllRanges();
+ var r1 = document.createRange();
+ r1.setStart(root, 0);
+ r1.setEnd(root, 0);
+ window.getSelection().addRange(r1);
+ looseText = document.createTextNode("c");
+ var r2 = document.createRange();
+ r2.setStart(looseText, 0);
+ r2.setEnd(looseText, 0);
+ window.getSelection().addRange(r2);
+
+ document.execCommand("forwardDelete", false, null);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/766795.html b/editor/libeditor/crashtests/766795.html
new file mode 100644
index 0000000000..b4ade30209
--- /dev/null
+++ b/editor/libeditor/crashtests/766795.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var fragEl = document.createElement("span");
+ fragEl.setAttribute("contenteditable", "true");
+ fragEl.setAttribute("style", "position: absolute;");
+
+ var frag = document.createDocumentFragment();
+ frag.appendChild(fragEl);
+
+ window.getSelection().selectAllChildren(fragEl);
+}
+
+</script>
+</head>
+
+<body contenteditable="true" onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/766845.xhtml b/editor/libeditor/crashtests/766845.xhtml
new file mode 100644
index 0000000000..409e210109
--- /dev/null
+++ b/editor/libeditor/crashtests/766845.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boom()
+{
+ window.getSelection().removeAllRanges();
+ var r1 = document.createRange();
+ r1.setStart(document.body, 0);
+ r1.setEnd (document.body, 1);
+ window.getSelection().addRange(r1);
+ var r2 = document.createRange();
+ r2.setStart(document.body, 1);
+ r2.setEnd (document.body, 2);
+ window.getSelection().addRange(r2);
+ if (document.queryCommandEnabled("inserthtml"))
+ document.execCommand("inserthtml", false, "1");
+}
+
+]]>
+</script>
+</head>
+
+<body contenteditable="true" onload="boom();"><div></div><div></div></body>
+
+</html>
diff --git a/editor/libeditor/crashtests/767169.html b/editor/libeditor/crashtests/767169.html
new file mode 100644
index 0000000000..a7673bce62
--- /dev/null
+++ b/editor/libeditor/crashtests/767169.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<script>
+
+// Document must not have a doctype to trigger the bug
+
+function boom()
+{
+ var root = document.documentElement;
+ while (root.firstChild) { root.firstChild.remove(); }
+ root.contentEditable = "true";
+ document.removeChild(root);
+ document.appendChild(root);
+ window.getSelection().collapse(root, 0);
+ window.getSelection().extend(document, 1);
+ document.removeChild(root);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/768748.html b/editor/libeditor/crashtests/768748.html
new file mode 100644
index 0000000000..09206dce3f
--- /dev/null
+++ b/editor/libeditor/crashtests/768748.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html contenteditable="true">
+<head>
+<script>
+
+function boom()
+{
+ var looseText = document.createTextNode("x");
+ window.getSelection().collapse(looseText, 0);
+ document.queryCommandState("insertorderedlist");
+}
+
+</script>
+</head>
+<body onload="setTimeout(boom, 0)"></body>
+</html>
diff --git a/editor/libeditor/crashtests/768765.html b/editor/libeditor/crashtests/768765.html
new file mode 100644
index 0000000000..551e4ec6c3
--- /dev/null
+++ b/editor/libeditor/crashtests/768765.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var root = document.documentElement;
+
+ while (root.firstChild) { root.firstChild.remove(); }
+
+ var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+ var div = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+ root.contentEditable = "true";
+ root.appendChild(div);
+ root.removeChild(div);
+ root.insertBefore(body, root.firstChild);
+
+ window.getSelection().removeAllRanges();
+ var r0 = document.createRange();
+ r0.setStart(body, 0);
+ r0.setEnd(body, 0);
+ window.getSelection().addRange(r0);
+ var r1 = document.createRange();
+ r1.setStart(div, 0);
+ r1.setEnd(div, 0);
+ window.getSelection().addRange(r1);
+
+ document.execCommand("inserthtml", false, "1");
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/769008-1.html b/editor/libeditor/crashtests/769008-1.html
new file mode 100644
index 0000000000..8ea8a3601d
--- /dev/null
+++ b/editor/libeditor/crashtests/769008-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var x = document.getElementById("x");
+
+ window.getSelection().removeAllRanges();
+
+ var range = document.createRange();
+ range.setStart(x, 0);
+ range.setEnd(x, 0);
+ window.getSelection().addRange(range);
+
+ document.execCommand("delete", false, "null");
+}
+
+</script>
+</head>
+<body contenteditable="true" onload="boom();"><div></div><span id="x"></span></body>
+</html>
diff --git a/editor/libeditor/crashtests/769967.xhtml b/editor/libeditor/crashtests/769967.xhtml
new file mode 100644
index 0000000000..af07571591
--- /dev/null
+++ b/editor/libeditor/crashtests/769967.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml" contenteditable="true" style="user-select: all;"><sub>x</sub><script>
+function boom()
+{
+ window.getSelection().removeAllRanges();
+ var r = document.createRange();
+ r.setStart(document.documentElement, 0);
+ r.setEnd(document.documentElement, 0);
+ window.getSelection().addRange(r);
+
+ document.execCommand("subscript", false, null);
+ document.execCommand("insertText", false, "y");
+}
+
+window.addEventListener("load", boom, false);
+
+</script></html>
diff --git a/editor/libeditor/crashtests/771749.html b/editor/libeditor/crashtests/771749.html
new file mode 100644
index 0000000000..9237364f2d
--- /dev/null
+++ b/editor/libeditor/crashtests/771749.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var root = document.documentElement;
+ root.contentEditable = "true";
+ document.removeChild(root);
+ document.appendChild(root);
+ document.execCommand("insertunorderedlist", false, null);
+ document.execCommand("inserthtml", false, "<span></span>");
+ document.execCommand("outdent", false, null);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/772282.html b/editor/libeditor/crashtests/772282.html
new file mode 100644
index 0000000000..bba3d6bd67
--- /dev/null
+++ b/editor/libeditor/crashtests/772282.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var root = document.documentElement;
+ while(root.firstChild) { root.firstChild.remove(); }
+ var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+ body.setAttributeNS(null, "contenteditable", "true");
+ var img = document.createElementNS("http://www.w3.org/1999/xhtml", "img");
+ body.appendChild(img);
+ root.appendChild(body);
+ document.removeChild(root);
+ document.appendChild(root);
+ document.execCommand("insertText", false, "5");
+ document.execCommand("selectAll", false, null);
+ document.execCommand("insertParagraph", false, null);
+ document.execCommand("increasefontsize", false, null);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/776323.html b/editor/libeditor/crashtests/776323.html
new file mode 100644
index 0000000000..9fc2776c37
--- /dev/null
+++ b/editor/libeditor/crashtests/776323.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html contenteditable="true">
+<head>
+<script>
+
+function boom()
+{
+ document.execCommand("inserthtml", false, "b");
+ var myrange = document.createRange();
+ myrange.selectNodeContents(document.getElementsByTagName("img")[0]);
+ window.getSelection().addRange(myrange);
+ document.execCommand("strikethrough", false, null);
+}
+
+</script>
+</head>
+<body onload="boom();"><img></body>
+</html>
diff --git a/editor/libeditor/crashtests/793866.html b/editor/libeditor/crashtests/793866.html
new file mode 100644
index 0000000000..4984474dbc
--- /dev/null
+++ b/editor/libeditor/crashtests/793866.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var b = document.body;
+ b.contentEditable = "true";
+ document.execCommand("contentReadOnly", false, null);
+ b.focus();
+ b.contentEditable = "false";
+ document.documentElement.contentEditable = "true";
+ document.createDocumentFragment().appendChild(b);
+ document.documentElement.focus();
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/848644.html b/editor/libeditor/crashtests/848644.html
new file mode 100644
index 0000000000..95570fabe3
--- /dev/null
+++ b/editor/libeditor/crashtests/848644.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<iframe src="data:text/html;charset=utf-8;base64,PGh0bWw+CjxoZWFkPgoJPHNjcmlwdD4KCQoJCXZhciBuID0gMDsKCQkKICAgICAgICB2YXIgU3ByYXkgPSBbXTsgICAgICAgICAgICAKICAgICAgICB2YXIgblNwcmF5ID0gMHgxMDA7ICAgICAgICAKCiAgICAKICAgIGZ1bmN0aW9uIHB0clRvU3RyaW5nKHB0cikKICAgIHsKICAgICAgICB2YXIgdGVtcCA9IHB0ci50b1N0cmluZygxNik7CiAgICAgICAgd2hpbGUgKHRlbXAubGVuZ3RoIDwgOCkKICAgICAgICAgICAgdGVtcCA9ICIwIiArIHRlbXA7CiAgICAgICAgYWQgPSAiJXUiOwogICAgICAgIGZvciAodmFyIGk9MDsgaTw0OyBpKyspCiAgICAgICAgICAgIGFkID0gYWQgKyB0ZW1wLmNoYXJBdCg0K2kpOwogICAgICAgIGFkICs9ICIldSI7CiAgICAgICAgZm9yICh2YXIgaT0wOyBpPDQ7IGkrKykKICAgICAgICAgICAgYWQgPSBhZCArIHRlbXAuY2hhckF0KGkpOwogICAgICAgIHJldHVybiBhZDsKICAgIH0KCiAgICAgICBmdW5jdGlvbiBzcHJheU1lbW9yeSgpCiAgICB7CiAgICAgICAgdmFyIHBhZ2Vfc2l6ZSA9IDB4MTAwMDAwIC0gMHgxMDAwOwogICAgICAgIHZhciBibG9jayA9ICIiOwoKICAgICAgICB3aGlsZSAoYmxvY2subGVuZ3RoICogMiA8IDB4MEM0KzB4MjAyMCkKICAgICAgICAgICAgYmxvY2sgKz0gcGFjaygweDkwOTA5MDkwKTsKICAgICAgICAKICAgICAgICB3aGlsZSAoYmxvY2subGVuZ3RoICogMiA8IHBhZ2Vfc2l6ZSkKICAgICAgICAgICAgYmxvY2sgKz0gIlx1OTA5MFx1OTA5MCI7CiAgICAgICAgICAgIAogICAgICAgIHZhciBzcHIgPSBibG9jay5zdWJzdHJpbmcoMCwgcGFnZV9zaXplIC8gMik7CiAgICAgICAgCiAgICAgICAgZm9yICh2YXIgaSA9IDA7IGkgPCBuU3ByYXk7IGkrKykKICAgICAgICAgICAgU3ByYXlbaV0gPSBbc3ByXS5qb2luKCIiKTsKICAgIH0KICAgICAgICAKCQlmdW5jdGlvbiBwYWNrKGEpCgkJewoJCQlyZXR1cm4gU3RyaW5nLmZyb21DaGFyQ29kZShhICYgMHhGRkZGKSArIFN0cmluZy5mcm9tQ2hhckNvZGUoYSA+PiAxNik7CgkJfQoJCQoJCXZhciAkID0gZnVuY3Rpb24oaWQpIHsgcmV0dXJuIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKGlkKTsgfQoJCQoJCXZhciBhbGxvYyA9IGZ1bmN0aW9uKHN6LCBwYXR0ZXJuPSdcdTQxNDEnKQoJCXsKCQkJc3ogLT0gMjsKCQkJaWYgKHN6IDwgMCkKCQkJCXJldHVybiBudWxsOwoJCQkKCQkJdmFyIHN0ciA9IHBhdHRlcm47CgkJCXdoaWxlIChzdHIubGVuZ3RoICogMiA8IHN6KQoJCQkJc3RyICs9IHBhdHRlcm47CgkJCgkJCXJldHVybiBzdHIuc3Vic3RyaW5nKDAsIHN6LzIpOwoJCX0KCQkKCQlmdW5jdGlvbiBhcHBlbmRJbnB1dChuLCB3aXRoSWRzPWZhbHNlKSAKCQl7CgkJCXZhciBib2R5ID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiYm9keSIpCgkJCXZhciBibG9jayA9IHBhY2soMHgyMDIwMjAyMCk7CgkJCXdoaWxlIChibG9jay5sZW5ndGggKiAyIDwgMHg1NCkKCQkJCWJsb2NrICs9IHBhY2soMHgyMDIwMjAyMCk7CgkJCWJsb2NrICs9IHBhY2soMHgyMDIwMjAyMCk7CgkJCXdoaWxlIChibG9jay5sZW5ndGggKiAyIDwgMHhDNCkKCQkJCWJsb2NrICs9IHBhY2soMHgyMDIwMjAyMCk7CgkJCWJsb2NrICs9IHBhY2soMHgyMDIwMjAyMCk7CgkJCXdoaWxlIChibG9jay5sZW5ndGggKiAyIDwgMHgyRDQgLSAyKQoJCQkJYmxvY2sgKz0gcGFjaygweDIwMjAyMDIwKTsKCQkgICAgdmFyIGIgPSBibG9jay5zdWJzdHJpbmcoMCwgMHgyRDIpOwoJCQlmb3IgKHZhciBpID0wOyBpPG47IGkrKykgCgkJCXsKCQkJCXZhciBpbnB1dCA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ2lucHV0JykKCQkJCWlmICh3aXRoSWRzID09IHRydWUpCgkJCQkJaW5wdXQuc2V0QXR0cmlidXRlKCdpZCcsICdpbnB1dCcgKyBpKTsKCQkJCWlucHV0LnZhbHVlID0gYgoJCQkJZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChpbnB1dCkKCQkJfQoJCX0KCQkKCQlmdW5jdGlvbiBjcmFmdEhlYXAobikKCQl7CgkJCWFwcGVuZElucHV0KG4sIHRydWUpOwoJCQlmb3IgKHZhciBpID0gMDsgaSA8IG47IGkgKz0gMikKCQkJCWRvY3VtZW50LmJvZHkucmVtb3ZlQ2hpbGQoJCgnaW5wdXQnICsgaSkpOwoJCX0KCQkKCQlmdW5jdGlvbiBzdGFydEZ1bigpCgkJewogICAgICAgICAgICAgICAgICAgICAgICBkb2N1bWVudC5kb2N1bWVudEVsZW1lbnQuZ2V0Qm91bmRpbmdDbGllbnRSZWN0KCk7CgkJCWNyYWZ0SGVhcCgweDEwKTsKCQkJZG9jdW1lbnQuZGVzaWduTW9kZSA9ICJvbiI7CgkJCWRvY3VtZW50LmRvY3VtZW50RWxlbWVudC5zdHlsZS5oZWlnaHQgPSAiMjAwcHgiOwoJCQkkKCdpZDEnKS5vZmZzZXRUb3A7CgkJfQoJCQoJCQoJCWZ1bmN0aW9uIGNhbGNNZUJhYmUoKQoJCXsKCQkJbisrOwoJCQlkb2N1bWVudC5leGVjQ29tbWFuZCgiaW5zZXJ0T3JkZXJlZExpc3QiLGZhbHNlLHRydWUpOwoJCQlkb2N1bWVudC53cml0ZSgnQUFBQUFBQUFBQUFBJyk7CQkKICAgICAgICAgICAgc3ByYXlNZW1vcnkoKTsKCQkJYXBwZW5kSW5wdXQoMHgxMDApOwoJCQkKCQkJZG9jdW1lbnQuZG9jdW1lbnRFbGVtZW50LnN0eWxlLmhlaWdodCA9ICIzMDBweCI7CgkJCWlmIChuID09IDIpCgkJCXsKICAgICAgICAgICAgICAgIHdpbmRvdy5yZW1vdmVFdmVudExpc3RlbmVyKCJyZXNpemUiLCBjYWxjTWVCYWJlLCBmYWxzZSk7CgkJCQloaXN0b3J5LmdvKC0xKTsKCQkJfQoKCQl9CgkJd2luZG93LmFkZEV2ZW50TGlzdGVuZXIoInJlc2l6ZSIsIGNhbGNNZUJhYmUsIGZhbHNlKTsKCTwvc2NyaXB0Pgo8L2hlYWQ+Cgk8Ym9keT4KCQk8ZGl2IGlkPSdpZDEnPiAgICA8L2Rpdj4KCQk8c2NyaXB0PnN0YXJ0RnVuKCk7PC9zY3JpcHQ+Cgk8L2JvZHk+CjwvaHRtbD4K" style="width: 100px; height: 100px"></iframe>
diff --git a/editor/libeditor/crashtests/crashtests.list b/editor/libeditor/crashtests/crashtests.list
new file mode 100644
index 0000000000..bc9b7a3f2d
--- /dev/null
+++ b/editor/libeditor/crashtests/crashtests.list
@@ -0,0 +1,117 @@
+load 336081-1.xhtml
+load 403965-1.xhtml
+load 428489-1.html
+load 429586-1.html
+load 431086-1.xhtml
+load 475132-1.xhtml
+load 503709-1.xhtml
+load 513375-1.xhtml
+load 535632-1.xhtml
+load 574558-1.xhtml
+load 580151-1.xhtml
+load 582138-1.xhtml
+load 633709.xhtml
+load 639736-1.xhtml
+load 713427-2.xhtml
+load 766360.html
+load 766387.html
+load 766413.html
+load 766795.html
+load 766845.xhtml
+load 767169.html
+load 768748.html
+load 768765.html
+load 769008-1.html
+load 769967.xhtml
+needs-focus load 771749.html
+load 772282.html
+load 776323.html
+needs-focus load 793866.html
+load 848644.html
+load 1057677.html
+needs-focus load 1128787.html
+load 1134545.html
+load 1158452.html
+load 1158651.html
+load 1244894.xhtml
+load 1264921.html
+load 1272490.html
+load 1274050.html
+load 1317704.html
+load 1317718.html
+load 1324505.html
+needs-focus load 1343918.html
+load 1344097.html
+load 1345015.html
+load 1348851.html
+load 1350772.html
+load 1364133.html
+load 1366176.html
+load 1375131.html
+load 1381541.html
+load 1383747.html
+load 1383755.html
+load 1383763.html
+load 1384161.html
+load 1388075.html
+load 1393171.html
+needs-focus load 1402196.html
+load 1402469.html
+load 1402526.html
+pref(dom.document.exec_command.nested_calls_allowed,true) asserts(1) load 1402904.html # assertion is that mutation event listener caused by execCommand calls another execCommand
+pref(dom.document.exec_command.nested_calls_allowed,true) asserts(1) load 1405747.html # assertion is that mutation event listener caused by execCommand calls another execCommand
+load 1405897.html
+load 1408170.html
+asserts(0-1) load 1414581.html
+load 1415231.html
+load 1423767.html
+needs-focus load 1423776.html
+skip-if(ThreadSanitizer) needs-focus load 1424450.html # bug 1718775, permafail on tsan
+load 1425091.html
+load 1426709.html
+needs-focus load 1429523.html
+needs-focus load 1429523.xhtml
+load 1441619.html
+load 1443664.html
+skip-if(Android) needs-focus load 1444630.html
+load 1446451.html
+pref(dom.document.exec_command.nested_calls_allowed,true) load 1464251.html
+pref(layout.accessiblecaret.enabled,true) load 1470926.html
+pref(dom.document.exec_command.nested_calls_allowed,true) asserts(2) load 1474978.html # assertion is that mutation event listener caused by execCommand calls another execCommand
+load 1517028.html
+load 1525481.html
+load 1533913.html
+load 1534394.html
+load 1547897.html
+load 1547898.html
+load 1556799.html
+load 1579934.html
+load 1574544.html
+load 1578916.html
+load 1581246.html
+load 1596516.html
+load 1605741.html
+load 1613521.html
+load 1618906.html
+load 1623166.html
+load 1623913.html
+load 1624005.html # throws
+load 1624007.html
+load 1624011.html
+load 1626002.html
+load 1636541.html
+load 1644903.html
+load 1645983-1.html
+load 1645983-2.html
+load 1648564.html
+load 1655539.html
+load 1659717.html
+load 1663725.html # throws
+load 1655508.html
+load 1655988.html
+pref(dom.document.exec_command.nested_calls_allowed,true) load 1666556.html
+load 1677566.html
+load 1691051.html
+load 1699866.html
+load 1701348.html
+load 1707630.html