summaryrefslogtreecommitdiffstats
path: root/editor/libeditor/crashtests/1626002.html
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--editor/libeditor/crashtests/1626002.html27
1 files changed, 27 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/1626002.html b/editor/libeditor/crashtests/1626002.html
new file mode 100644
index 0000000000..55099cb648
--- /dev/null
+++ b/editor/libeditor/crashtests/1626002.html
@@ -0,0 +1,27 @@
+<html>
+<head>
+<script>
+addEventListener("load", () => {
+ const anchor = document.createElement("a");
+ const b = document.createElement("b");
+ const c = document.createElement("c");
+ document.documentElement.appendChild(anchor);
+ anchor.appendChild(b);
+ b.setAttribute("contenteditable", "true");
+ // For emulating the traditional behavior, collapse Selection to end of the
+ // <body> which must be empty because this test appends the new elements after
+ // the <body>.
+ const selection = self.getSelection();
+ selection.collapse(document.body, document.body.childNodes.length);
+ b.appendChild(c);
+ c.outerHTML = '<s contenteditable="false"><b contenteditable="true">';
+ selection.setBaseAndExtent(document, 0, document.documentElement, 0);
+ const range = selection.getRangeAt((260523900 % selection.rangeCount));
+ selection.selectAllChildren(b);
+ range.collapse(false);
+ range.setEndAfter(document.documentElement);
+ range.extractContents();
+});
+</script>
+</head>
+</html>