summaryrefslogtreecommitdiffstats
path: root/editor/libeditor/crashtests/1405897.html
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--editor/libeditor/crashtests/1405897.html23
1 files changed, 23 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/1405897.html b/editor/libeditor/crashtests/1405897.html
new file mode 100644
index 0000000000..60118628b5
--- /dev/null
+++ b/editor/libeditor/crashtests/1405897.html
@@ -0,0 +1,23 @@
+<style>
+* { position: absolute; }
+</style>
+<script>
+function onLoad() {
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // text node in the <iframe> which is the last child of the <body>. Note that
+ // <iframe> is treated as a container in HTMLEditor.
+ const iframe = document.querySelector("iframe");
+ getSelection().collapse(iframe.firstChild, iframe.firstChild.length);
+ document.querySelector("del").addEventListener("DOMSubtreeModified", () => {
+ document.execCommand("italic");
+ document.execCommand("selectAll");
+ });
+ const anchor = document.querySelector("a[contenteditable]");
+ anchor.replaceChild(iframe, anchor.childNodes[0]);
+}
+</script>
+<body onload="onLoad()">
+<a contenteditable>
+<del>
+<iframe>
+</body> \ No newline at end of file