summaryrefslogtreecommitdiffstats
path: root/editor/libeditor/crashtests/1383755.html
blob: 3cbfe08d17abd762bcb1a9855c71b35cf69be3a4 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
<html>
  <head>
    <script type="application/javascript">
      let table = document.createElement('table');
      document.documentElement.appendChild(table);
      let tr = document.createElement('tr');
      table.appendChild(tr);
      let input = document.createElement('input');
      document.documentElement.appendChild(input);

      let img = document.createElement('img');
      input.appendChild(img);
      img.contentEditable = 'true'
      tr.appendChild(img);
      img.offsetParent;

      // Since table's cell is selected by the following, it will show
      // object resizer that is anonymous element.
      window.getSelection().selectAllChildren(tr);
      // Document.adoptNode will remove anonymous element of object resizer
      // and it shouldn't cause crash
      document.implementation.createDocument('', '').adoptNode(table);
    </script>
  </head>
</html>