diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 09:22:09 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 09:22:09 +0000 |
| commit | 43a97878ce14b72f0981164f87f2e35e14151312 (patch) | |
| tree | 620249daf56c0258faa40cbdcf9cfba06de2a846 /testing/web-platform/tests/editing/crashtests | |
| parent | Initial commit. (diff) | |
| download | firefox-upstream.tar.xz firefox-upstream.zip | |
Adding upstream version 110.0.1.upstream/110.0.1upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'testing/web-platform/tests/editing/crashtests')
76 files changed, 1672 insertions, 0 deletions
diff --git a/testing/web-platform/tests/editing/crashtests/backcolor-in-nested-editing-host-td-from-DOMAttrModified.html b/testing/web-platform/tests/editing/crashtests/backcolor-in-nested-editing-host-td-from-DOMAttrModified.html new file mode 100644 index 0000000000..f8f004b910 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/backcolor-in-nested-editing-host-td-from-DOMAttrModified.html @@ -0,0 +1,29 @@ +<html class="test-wait"> +<head> +<script type="text/javascript"> +function boom() +{ + function x() + { + document.removeEventListener("DOMAttrModified", x); + document.execCommand("backcolor", false, "green"); + } + + document.getElementById("td").focus(); + + document.addEventListener("DOMAttrModified", x); + try { + document.execCommand("subscript", false, null); + } catch(e) { + } + document.removeEventListener("DOMAttrModified", x); + document.documentElement.removeAttribute("class"); +} +</script> +</head> + +<body contenteditable="true" onload="setTimeout(boom, 30);"> +<table><tbody contenteditable="false"><tr><td contenteditable="true" id="td"></td></tr></tbody></table> +</body> + +</html> diff --git a/testing/web-platform/tests/editing/crashtests/bold-in-output.html b/testing/web-platform/tests/editing/crashtests/bold-in-output.html new file mode 100644 index 0000000000..43d78ec4e9 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/bold-in-output.html @@ -0,0 +1,20 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<style> +* { font-weight: bolder } +</style> +<script> +document.addEventListener("DOMContentLoaded", () => { + document.querySelector("output").focus(); + document.execCommand("selectAll"); + document.execCommand("bold"); +}) +</script> +</head> +<body> +<output contenteditable="true"> +A +</output></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/contenteditable-will-be-blurred-by-focus-event-listener.html b/testing/web-platform/tests/editing/crashtests/contenteditable-will-be-blurred-by-focus-event-listener.html new file mode 100644 index 0000000000..a887b1de90 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/contenteditable-will-be-blurred-by-focus-event-listener.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html class="test-wait"> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + const editingHost = document.querySelector("div[contenteditable]"); + editingHost.addEventListener("focus", () => { + document.execCommand("insertText", false, "def"); + editingHost.parentElement.setAttribute("hidden", "hidden"); + setTimeout(() => document.documentElement.removeAttribute("class"), 0); + }); + editingHost.focus(); +}); +</script> +<div><div contenteditable>abc</div></div> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/crash-test.html b/testing/web-platform/tests/editing/crashtests/crash-test.html new file mode 100644 index 0000000000..a7baba30ec --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/crash-test.html @@ -0,0 +1,24 @@ +<!DOCTYPE html> +<meta charset="utf-8"> +<title>Testcase for bug 1273593 of Chromium</title> +<script type="text/javascript"> + function eventhandle_n0BpsTiUS(){ + document.getElementById('id_xEmarzXTw').getBoundingClientRect(); + create_object_mJ9MFgX5.appendChild(document.getElementById('id_nJMWIU7Mp')); + } + function operate(){ + document.getElementById('id_VQmNKZL69').addEventListener('pause', eventhandle_n0BpsTiUS); + create_object_mJ9MFgX5 = document.createElement("canvas"); + event = new Event('pause') + document.getElementById('id_VQmNKZL69').dispatchEvent(event) + }// end exec_event +</script> +<body onload="operate();" contentEditable="true"> + <menu id='id_xEmarzXTw'> + <i id='id_VQmNKZL69' onfocusout='eventhandle_n0BpsTiUS();'> + <nobr id='id_nJMWIU7Mp' > + <iframe onpointerover='eventhandle_n0BpsTiUS();'></iframe> + </nobr> + </i> + </menu> +</body> diff --git a/testing/web-platform/tests/editing/crashtests/delete-and-justifycenter-recursively-with-mutation-event-listeners.html b/testing/web-platform/tests/editing/crashtests/delete-and-justifycenter-recursively-with-mutation-event-listeners.html new file mode 100644 index 0000000000..ce0c7e886f --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-and-justifycenter-recursively-with-mutation-event-listeners.html @@ -0,0 +1,34 @@ +<!doctype html> +<html class="test-wait"> +<head> +<meta charset="utf-8"> +<script> +try { + function onDOMNodeInsertedOfContentEditable() { + getSelection().collapse(document.querySelector("input")); + document.execCommand("justifyCenter"); + document.querySelector("dl").addEventListener("DOMSubtreeModified", onDOMSubtreeModifiedOfDLElement); + document.querySelector("dl").appendChild(document.querySelector("style")); + } + function onDOMSubtreeModifiedOfDLElement() { + document.execCommand("delete"); + document.querySelector("label").appendChild(document.querySelector("input")); + document.querySelector("dd[contenteditable]").addEventListener("DOMNodeInserted", onDOMNodeInsertedOfContentEditable); + } + addEventListener("load", () => { + onDOMNodeInsertedOfContentEditable(); + document.documentElement.removeAttribute("class"); + }); +} catch (ex) { + // maybe too many recursive exception would be thrown. + document.documentElement.removeAttribute("class"); +} +</script> +</head> +<body><label></label> +<dl> +<dd contenteditable> +<style>@</style> +<input> +</body> +</html>
\ No newline at end of file diff --git a/testing/web-platform/tests/editing/crashtests/delete-content-in-no-data-object.html b/testing/web-platform/tests/editing/crashtests/delete-content-in-no-data-object.html new file mode 100644 index 0000000000..749dba303b --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-content-in-no-data-object.html @@ -0,0 +1,31 @@ +<!doctype html> +<html class="test-wait"> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + requestAnimationFrame(() => { + setTimeout(() => { + document.execCommand("delete"); + document.documentElement.removeAttribute("class"); + }, 0); + document.execCommand("insertImage", false, "x"); + }); + document.execCommand("justifyCenter"); +}) +function onError() { + document.querySelector("s").before("BEFORE"); + document.designMode = "on"; + const img = document.querySelector("img"); + img.innerHTML = "IMG"; + getSelection().setBaseAndExtent(document.querySelector("kbd"), 0, img, 1); +} +</script> +</head> +<body><object onerror="onError()"> +<s> +<img> +SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS +<kbd> +</kbd></s></object></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-with-focus.html b/testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-with-focus.html new file mode 100644 index 0000000000..585cd17bb8 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-with-focus.html @@ -0,0 +1,12 @@ +<script> +addEventListener("DOMContentLoaded", () => { + document.querySelector("dd[contenteditable]").focus(); + document.querySelector("dd[contenteditable]").addEventListener("DOMNodeRemoved", () => { + document.querySelector("h6").textContent = ""; + }); + document.execCommand("selectAll"); + document.execCommand("delete"); +}) +</script> +<h6> +<dd contenteditable> diff --git a/testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-without-focus.html b/testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-without-focus.html new file mode 100644 index 0000000000..a45f2dad82 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-without-focus.html @@ -0,0 +1,12 @@ +<script> +addEventListener("DOMContentLoaded", () => { + document.querySelector("dd[contenteditable]").blur(); + document.querySelector("dd[contenteditable]").addEventListener("DOMNodeRemoved", () => { + document.querySelector("h6").textContent = ""; + }); + document.execCommand("selectAll"); + document.execCommand("delete"); +}) +</script> +<h6> +<dd contenteditable> diff --git a/testing/web-platform/tests/editing/crashtests/delete-in-designMode-without-explicitly-setting-focus.html b/testing/web-platform/tests/editing/crashtests/delete-in-designMode-without-explicitly-setting-focus.html new file mode 100644 index 0000000000..16e1808dc8 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-in-designMode-without-explicitly-setting-focus.html @@ -0,0 +1,17 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + const dl = document.querySelector("dl"); + dl.textContent = "�"; + document.designMode = "on"; + document.execCommand("delete"); +}) +</script> +</head> +<del> + <dl></dl> +</del> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/delete-in-empty-editable-list-followed-by-non-editable-listitem.html b/testing/web-platform/tests/editing/crashtests/delete-in-empty-editable-list-followed-by-non-editable-listitem.html new file mode 100644 index 0000000000..9e872f5ac4 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-in-empty-editable-list-followed-by-non-editable-listitem.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<html id="a"> +<meta charset="utf-8"> +<script id="b"> +window.onload = () => { + c.appendChild(document.head) + a.appendChild(d) + document.execCommand("selectAll") + document.execCommand("delete") +} +</script> +<dl id="c" contenteditable="true"> +<dt id="d"> diff --git a/testing/web-platform/tests/editing/crashtests/designMode-document-will-be-blurred-by-focus-event-listener.html b/testing/web-platform/tests/editing/crashtests/designMode-document-will-be-blurred-by-focus-event-listener.html new file mode 100644 index 0000000000..3cd6509c4b --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/designMode-document-will-be-blurred-by-focus-event-listener.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html class="test-wait"> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + const parentDocument = document; + const iframe = parentDocument.querySelector("iframe"); + iframe.contentDocument.designMode = "on"; + iframe.contentWindow.addEventListener("focus", () => { + iframe.contentDocument.execCommand("insertText", false, "def"); + iframe.parentElement.setAttribute("hidden", "hidden"); + setTimeout(() => parentDocument.documentElement.removeAttribute("class"), 0); + }); + iframe.contentWindow.focus(); +}); +</script> +<div><iframe srcdoc="<div>abc</div>"></iframe></div> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/execCommand-at-load-with-changing-editing-host.html b/testing/web-platform/tests/editing/crashtests/execCommand-at-load-with-changing-editing-host.html new file mode 100644 index 0000000000..ec1dd30dc0 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/execCommand-at-load-with-changing-editing-host.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html contenteditable="true"> +<head> +<meta charset="utf-8"> +<title>Test for bug 615450 of Mozilla</title> +<script> +function boom() +{ + document.documentElement.appendChild(document.body); + document.documentElement.contentEditable = "false"; + try { document.execCommand("outdent", false, null); } catch(e) { } + document.body.contentEditable = "true"; + try { document.execCommand("inserthtml", false, "x"); } catch(e) { } +} +</script> +</head> +<body onload="boom();"><div style="margin-left: 40px;"><span contenteditable="true">p q r s</span> T</div></body></html> diff --git a/testing/web-platform/tests/editing/crashtests/execCommand-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html b/testing/web-platform/tests/editing/crashtests/execCommand-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html new file mode 100644 index 0000000000..0750dddca7 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/execCommand-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html @@ -0,0 +1,116 @@ +<!DOCTYPE HTML> +<html><head> + <meta charset="iso-8859-1"> + <title>Testcase #3 for bug 448329 of Bugzilla</title> +</head> +<body> + +<iframe id="frame448329"></iframe> + +<script> + +function test448329(id,cmd,val) { + + var elm = document.getElementById(id); + var doc = elm.contentDocument; + doc.designMode = "On"; + + doc.body.offsetWidth; + var selection = doc.defaultView.getSelection(); + + // Test document node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + var range = doc.createRange(); + range.setStart(doc, 0); + range.setEnd(doc, 0); + selection.addRange(range); + doc.execCommand(cmd,false,val); + + // Test HTML node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + range = doc.createRange(); + range.setStart(doc.documentElement, 0); + range.setEnd(doc.documentElement, 0); + selection.addRange(range); + doc.execCommand(cmd,false,val); + + // Test BODY node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + range = doc.createRange(); + var body = doc.documentElement.childNodes[1]; + range.setStart(body, 0); + range.setEnd(body, 0); + selection.addRange(range); + doc.execCommand(cmd,false,val); + + var text = doc.createTextNode("Hello Kitty"); + body.insertBefore(text, null) + + // Test TEXT node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + range = doc.createRange(); + range.setStart(text, 0); + range.setEnd(text, 1); + selection.addRange(range); + doc.execCommand(cmd,false,val); + + // Test BODY[0,0] + TEXT node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + range = doc.createRange(); + range.setStart(body, 0); + range.setEnd(body, 0); + selection.addRange(range); + range = doc.createRange(); + range.setStart(text, 0); + range.setEnd(text, 1); + selection.addRange(range); + doc.execCommand(cmd,false,val); + + // Test BODY[0,1] + TEXT node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + range = doc.createRange(); + range.setStart(body, 0); + range.setEnd(body, 1); + selection.addRange(range); + range = doc.createRange(); + range.setStart(text, 0); + range.setEnd(text, 1); + selection.addRange(range); + doc.execCommand(cmd,false,val); + + // Test BODY[0,1] + TEXT node without a parent + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + range = doc.createRange(); + range.setStart(body, 0); + range.setEnd(body, 1); + selection.addRange(range); + range = doc.createRange(); + text = doc.createTextNode("Hello there"); // not in doc + range.setStart(text, 0); + range.setEnd(text, 1); + selection.addRange(range); + doc.execCommand(cmd,false,val); +} + +test448329("frame448329", "backcolor", "green") +test448329("frame448329", "hilitecolor", "green") + +</script> + + +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/execCommand-without-selection-ranges.html b/testing/web-platform/tests/editing/crashtests/execCommand-without-selection-ranges.html new file mode 100644 index 0000000000..04913664e6 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/execCommand-without-selection-ranges.html @@ -0,0 +1,65 @@ +<!doctype html> +<head> +<meta charset="utf-8"> +</head> +<body> +<script> +for (const command of [ + ["bold", ""], + ["italic", ""], + ["underline", ""], + ["strikethrough", ""], + ["subscript", ""], + ["superscript", ""], + ["cut", ""], + ["copy", ""], + ["paste", ""], + ["delete", ""], + ["forwarddelete", ""], + ["selectall", ""], + ["undo", ""], + ["redo", ""], + ["indent", ""], + ["outdent", ""], + ["backcolor", "#888888"], + ["forecolor", "#888888"], + ["hilitecolor", "#888888"], + ["fontname", "Courier"], + ["fontsize", "6"], + ["increasefontsize", ""], + ["decreasefontsize", ""], + ["inserthorizontalrule", ""], + ["createlink", "foo"], + ["insertimage", "foo"], + ["inserthtml", "foo"], + ["inserttext", "foo"], + ["insertparagraph", ""], + ["gethtml", ""], + ["justifyleft", ""], + ["justifyright", ""], + ["justifycenter", ""], + ["justifyfull", ""], + ["removeformat", ""], + ["unlink", ""], + ["insertorderedlist", ""], + ["insertunorderedlist", ""], + ["formatblock", "h1"], + ["heading", "h1"], + ["stylewithcss", "true"], + ["usecss", "true"], + ["contentreadonly", "true"], + ["readonly", "true"], + ["insertbronreturn", "true"], + ["enableobjectresizing", "true"], + ["enableinlinetableediting", "true"], +]) { + document.body.innerHTML = "<div contenteditable>abc</div>"; + document.querySelector("div[contenteditable]").focus(); + getSelection().removeAllRanges(); + try { + document.execCommand(command[0], false, command[1]); + } catch(e) {} +} +</script> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/format-block-selection-containing-non-editable-list.html b/testing/web-platform/tests/editing/crashtests/format-block-selection-containing-non-editable-list.html new file mode 100644 index 0000000000..2f8f8ea5ab --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/format-block-selection-containing-non-editable-list.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> + <script> + window.addEventListener('load', () => { + document.execCommand('selectAll', false, null) + document.execCommand('formatBlock', false, 'h1') + }) + </script> +</head> +<body> +<main contenteditable='true'> + <li></li> + <ol contenteditable='false'> + </ol> +</main> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/forwarddelete-at-empty-text-node-in-body.html b/testing/web-platform/tests/editing/crashtests/forwarddelete-at-empty-text-node-in-body.html new file mode 100644 index 0000000000..4fba13d5d8 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/forwarddelete-at-empty-text-node-in-body.html @@ -0,0 +1,8 @@ +<body contenteditable=true>x y +<script> +document.body.firstChild.splitText(2) // "x " and " y" + .splitText(1) // "x", " " and " y" + .splitText(1); // "x", "", " " and " y" +getSelection().collapse(document.body, 1); +document.execCommand("forwardDelete"); +</script> diff --git a/testing/web-platform/tests/editing/crashtests/forwarddelete-delete-after-justifyleft-indent.html b/testing/web-platform/tests/editing/crashtests/forwarddelete-delete-after-justifyleft-indent.html new file mode 100644 index 0000000000..0b0e188732 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/forwarddelete-delete-after-justifyleft-indent.html @@ -0,0 +1,20 @@ +<script> +document.addEventListener("DOMContentLoaded", () => { + const fieldset = document.querySelector("fieldset"); + document.documentElement.contentEditable = true; + fieldset.contentEditable = false; + document.execCommand("justifyLeft"); + document.designMode = "on"; + document.execCommand("indent"); + document.execCommand("forwardDelete"); + document.execCommand("delete"); +}); +</script> +<acronym readonly autofocus> +<sup> +<fieldset> + +here is fieldset +</fieldset> +</acronym> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-with-focus.html b/testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-with-focus.html new file mode 100644 index 0000000000..266cc4fb60 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-with-focus.html @@ -0,0 +1,15 @@ +<script> +addEventListener("load", () => { + document.querySelector("ol[contenteditable]").focus(); + document.execCommand("selectAll"); + const targetListItem = document.querySelector("li + li"); + targetListItem.addEventListener("DOMSubtreeModified", () => { + document.execCommand("forwardDelete"); + document.querySelector("script").appendChild(targetListItem); + }); + targetListItem.setAttribute("scrolling", "auto"); +}); +</script> +<ol contenteditable> +<li> +<li>a</li> diff --git a/testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-without-focus.html b/testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-without-focus.html new file mode 100644 index 0000000000..de10e8b8a9 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-without-focus.html @@ -0,0 +1,15 @@ +<script> +addEventListener("load", () => { + document.querySelector("ol[contenteditable]").blur(); + document.execCommand("selectAll"); + const targetListItem = document.querySelector("li + li"); + targetListItem.addEventListener("DOMSubtreeModified", () => { + document.execCommand("forwardDelete"); + document.querySelector("script").appendChild(targetListItem); + }); + targetListItem.setAttribute("scrolling", "auto"); +}); +</script> +<ol contenteditable> +<li> +<li>a</li> diff --git a/testing/web-platform/tests/editing/crashtests/forwarddelete-in-text-in-span-in-editable-documentElement.html b/testing/web-platform/tests/editing/crashtests/forwarddelete-in-text-in-span-in-editable-documentElement.html new file mode 100644 index 0000000000..26f2f64b81 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/forwarddelete-in-text-in-span-in-editable-documentElement.html @@ -0,0 +1,15 @@ +<!doctype html> +<script> +addEventListener("load", () => { + const r = document.documentElement; + while (r.firstChild) { + r.firstChild.remove(); + } + + document.documentElement.contentEditable = "true"; + document.documentElement.appendChild(document.createElement("span")); + document.documentElement.firstChild.appendChild(document.createTextNode("_")); + document.execCommand("forwarddelete"); +}); +</script> +<body> diff --git a/testing/web-platform/tests/editing/crashtests/indent-outdent-after-closing-editable-dialog-element.html b/testing/web-platform/tests/editing/crashtests/indent-outdent-after-closing-editable-dialog-element.html new file mode 100644 index 0000000000..7f73de048d --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/indent-outdent-after-closing-editable-dialog-element.html @@ -0,0 +1,31 @@ +<html class="reftest-wait"> +<script> +var eventCount = 0; +document.addEventListener("DOMContentLoaded", () => { + const dialog = document.querySelector("dialog"); + const object = document.createElement("object"); + object.addEventListener("DOMSubtreeModified", () => { + dialog.show(); + dialog.focus(); + document.execCommand("selectAll"); + dialog.close(); + setTimeout(() => { + document.execCommand("selectAll"); + document.execCommand("strikeThrough"); + document.execCommand("indent"); + document.execCommand("outdent"); + eventCount--; + if (!eventCount) { + document.documentElement.removeAttribute("class"); + } + }); + eventCount++; + }); + object.setAttribute("role", "x"); // Run DOMSubtreeModified + object.setAttribute("role", "y"); // Run DOMSubtreeModified + document.execCommand("forwardDelete"); + document.execCommand("justifyRight"); +}) +</script> +<dialog id="a" contenteditable="true">a</dialog> +</html>
\ No newline at end of file diff --git a/testing/web-platform/tests/editing/crashtests/insert-image-with-joining-header-element-and-body.html b/testing/web-platform/tests/editing/crashtests/insert-image-with-joining-header-element-and-body.html new file mode 100644 index 0000000000..cf5b2df225 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insert-image-with-joining-header-element-and-body.html @@ -0,0 +1,24 @@ +<!DOCTYPE html> +<html> +<head> + <script> + window.addEventListener("load", () => { + const heading = document.getElementById("heading") + const input = document.createElementNS("http://www.w3.org/1999/xhtml", "input") + heading.appendChild(input) + const selection = window.getSelection() + const range = new Range() + range.setStartBefore(input) + heading.contentEditable = true + document.execCommand("selectAll", false, null) + document.designMode = "on" + selection.addRange(range) + range.setEndBefore(heading) + range.setEndAfter(heading) + document.execCommand("insertImage", false, "wss://:pass@[::1]$/") + }) + </script> +</head> +<h4 id="heading"></h4> +<!-- COMMENT --> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertText-at-end-of-text-in-body.html b/testing/web-platform/tests/editing/crashtests/insertText-at-end-of-text-in-body.html new file mode 100644 index 0000000000..763697314b --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertText-at-end-of-text-in-body.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener("load", event => { + document.body.focus(); + const text = document.createTextNode("x".repeat(15)); + document.body.appendChild(text); + getSelection().collapse(text, text.length); + document.execCommand("insertText", false, "a"); +}); +</script> +</head> +<body contenteditable></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-fieldset-and-everything-styled-white-space-pre.html b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-fieldset-and-everything-styled-white-space-pre.html new file mode 100644 index 0000000000..d06157e784 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-fieldset-and-everything-styled-white-space-pre.html @@ -0,0 +1,25 @@ +<!DOCTYPE html> +<html> +<head> + <style> + * { + white-space: pre + } + </style> + <script> + document.addEventListener('DOMContentLoaded', () => { + const quote_0 = document.getElementById('id_0') + const quote_1 = document.createElement('blockquote') + const fieldset_1 = document.createElement('fieldset') + quote_1.appendChild(fieldset_1) + document.documentElement.appendChild(quote_1) + const selection = self.getSelection() + selection.collapse(fieldset_1, 0) + quote_0.contentEditable = false + document.documentElement.contentEditable = true + document.execCommand('insertHorizontalRule', false, null) + }) + </script> +</head> +<blockquote id='id_0'></blockquote> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-textarea-in-editor-and-undo-on-error-events.html b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-textarea-in-editor-and-undo-on-error-events.html new file mode 100644 index 0000000000..204f75a89f --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-textarea-in-editor-and-undo-on-error-events.html @@ -0,0 +1,31 @@ +<!doctype html> +<html class="test-wait"> +<head> +<meta charset="utf-8"> +<script> +var count = 0; +function onError() { + if (++count > 2) { + document.documentElement.removeAttribute("class"); + return; + } + const object = document.getElementById("a"); + const mi = document.getElementById("b"); + object.data = ""; + object.appendChild(document.getElementById("c")); + mi.appendChild(document.getElementById("c")); + getSelection().collapse(document.getElementById("c"), 0); + document.execCommand("undo"); + document.execCommand("insertHorizontalRule"); +} +</script> +</head> +<body> +<textarea id="c">a</textarea> +<dt contenteditable="true"> +<mi id="b">#</mi> +<object id="a" onerror="onError()"> +</object> +</dt> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-2-selection-ranges-and-one-is-outside-body.html b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-2-selection-ranges-and-one-is-outside-body.html new file mode 100644 index 0000000000..d248c333d9 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-2-selection-ranges-and-one-is-outside-body.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener('DOMContentLoaded', () => { + const form = document.createElement("form"); + const range = new Range(); + document.documentElement.contentEditable = true; + document.execCommand("formatBlock", false, "h3"); + document.documentElement.appendChild(form); + range.setStartBefore(form); + getSelection().addRange(range); + range.selectNode(form); + document.execCommand("insertHorizontalRule"); +}); +</script> +</head> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-selecting-text-in-document-element.html b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-selecting-text-in-document-element.html new file mode 100644 index 0000000000..c46b0359e8 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-selecting-text-in-document-element.html @@ -0,0 +1,18 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + const text = document.createTextNode("abc"); + document.documentElement.appendChild(text); + const range = new Range(); + range.selectNodeContents(text); + document.documentElement.contentEditable = "true"; + document.execCommand("insertUnorderedList"); + getSelection().addRange(range); + document.execCommand("insertHorizontalRule"); +}); +</script> +</head> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthtml-after-temporarily-removing-document-element.html b/testing/web-platform/tests/editing/crashtests/inserthtml-after-temporarily-removing-document-element.html new file mode 100644 index 0000000000..7245fe3ddc --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthtml-after-temporarily-removing-document-element.html @@ -0,0 +1,27 @@ +<!DOCTYPE html> +<html class="test-wait"> +<head> +<meta charset="utf-8"> +<title>Testcase for bug 716456 of Mozilla</title> +<script> +function boom() { + const div = document.querySelector("div"); + div.contentEditable = "true"; + div.focus(); + + const root = document.documentElement; + document.removeChild(root); + document.appendChild(root); + + setTimeout(() => { + getSelection().collapse(div, 0); + document.execCommand("inserthtml", false, "a"); + setTimeout(() => { + document.documentElement.removeAttribute("class"); + }, 0); + }, 0); +} +</script> +</head> +<body onload="boom();"><div></div></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthtml-in-inline-editing-host-at-load-event.html b/testing/web-platform/tests/editing/crashtests/inserthtml-in-inline-editing-host-at-load-event.html new file mode 100644 index 0000000000..22f172856a --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthtml-in-inline-editing-host-at-load-event.html @@ -0,0 +1,7 @@ +<html> +<head> +</head> + +<body onload="try { document.execCommand('inserthtml', false, '0'); } catch(e) { }"><span id="textarea" contenteditable="true">is</span></body> + +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthtml-in-text-adopted-to-other-document.html b/testing/web-platform/tests/editing/crashtests/inserthtml-in-text-adopted-to-other-document.html new file mode 100644 index 0000000000..d8234f917a --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthtml-in-text-adopted-to-other-document.html @@ -0,0 +1,52 @@ +<!DOCTYPE html> +<html class="test-wait"> +<head> +<script> +function init1() +{ + targetIframe = document.createElementNS('http://www.w3.org/1999/xhtml', 'iframe'); + targetIframe.srcdoc = "<html></html>"; + targetIframe.setAttribute("style", "width: 300px; height: 200px; border: 1px dotted green;"); + targetIframe.addEventListener("load", init2); + document.body.appendChild(targetIframe); +} + +function init2() +{ + targetWindow = targetIframe.contentWindow; + targetDocument = targetWindow.document; + + var div = document.getElementById("div"); + textNode = div.firstChild; + + targetDocument.body.appendChild(targetDocument.adoptNode(div, true)); + + targetDocument.designMode = 'on'; + setTimeout(init3, 0); +} + +function init3() +{ + var rng = targetDocument.createRange(); + rng.setStart(textNode, 1); + rng.setEnd(textNode, 1); + targetWindow.getSelection().addRange(rng); + + try { + targetDocument.execCommand("inserthtml", false, "<p>"); + } catch(e) {} + + document.documentElement.removeAttribute("class"); +} +</script> + +</head> + +<body onload="init1();"> + +<div id="div"> </div> + +<script> +</script> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthtml-indent-delete-when-input-element-in-editing-host-has-focus.html b/testing/web-platform/tests/editing/crashtests/inserthtml-indent-delete-when-input-element-in-editing-host-has-focus.html new file mode 100644 index 0000000000..ff1eebe041 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthtml-indent-delete-when-input-element-in-editing-host-has-focus.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<title>Test for bug 636074 of Mozilla</title> +<script> +function boom() +{ + document.getElementById("i").focus(); + document.documentElement.contentEditable = "true"; + document.execCommand("inserthtml", false, "<table>"); + document.execCommand("indent", false, null); + document.execCommand("delete", false, null); +} +</script> +</head> +<body onload="boom();"><input id="i"></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertlinebreak-around-comment-node.html b/testing/web-platform/tests/editing/crashtests/insertlinebreak-around-comment-node.html new file mode 100644 index 0000000000..dc2d5e2bd4 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertlinebreak-around-comment-node.html @@ -0,0 +1,20 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + const element_0 = document.createElement("s"); + const element_1 = document.createElement("a"); + const element_2 = document.createElement("l"); + element_2.setAttribute("contenteditable", "true"); + element_1.appendChild(element_2); + element_0.appendChild(element_1); + document.documentElement.appendChild(element_0); + document.designMode = "on"; + document.execCommand("insertLineBreak"); +}); +</script> +</head> +<body><!-- COMMENT --></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertlinebreak-in-map-element-editing-host.html b/testing/web-platform/tests/editing/crashtests/insertlinebreak-in-map-element-editing-host.html new file mode 100644 index 0000000000..c141f89c4e --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertlinebreak-in-map-element-editing-host.html @@ -0,0 +1,12 @@ +<!DOCTYPE html> +<meta charset="utf-8"> +<script> + document.addEventListener("DOMContentLoaded", () => { + document.getElementById("id_0").contentEditable = false; + document.querySelector("[contenteditable]").focus(); + document.execCommand("insertLineBreak"); + }) +</script> +<pre> +<ins id="id_0"> +<map contenteditable>
\ No newline at end of file diff --git a/testing/web-platform/tests/editing/crashtests/insertorderedlist-in-focused-inline-editing-host.html b/testing/web-platform/tests/editing/crashtests/insertorderedlist-in-focused-inline-editing-host.html new file mode 100644 index 0000000000..73869af3b5 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertorderedlist-in-focused-inline-editing-host.html @@ -0,0 +1,23 @@ +<!DOCTYPE html> +<html class="test-wait"> +<head> +<script type="text/javascript"> + +function boom() +{ + const inlineEditingHost = document.getElementById("s"); + inlineEditingHost.addEventListener("focus", () => { + try { + document.execCommand("insertorderedlist"); + } catch(e) { } + document.documentElement.removeAttribute("class"); + }, {once: true}); + inlineEditingHost.focus(); +} + +</script> +</head> + +<body onload="boom();"><span id="s" contenteditable="true">One<div></div></span><marquee></marquee></body> + +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertorderedlist-in-text-adopted-to-other-document.html b/testing/web-platform/tests/editing/crashtests/insertorderedlist-in-text-adopted-to-other-document.html new file mode 100644 index 0000000000..e505e5bf2f --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertorderedlist-in-text-adopted-to-other-document.html @@ -0,0 +1,49 @@ +<!DOCTYPE html> +<html class="test-wait"> +<head> +<script> +function init1() +{ + // Create an html:iframe in HTML mode (so designMode can be used 320092) + targetIframe = document.createElementNS('http://www.w3.org/1999/xhtml', 'iframe'); + targetIframe.srcdoc = "<html></html>"; + targetIframe.setAttribute("style", "width: 700px; height: 500px; border: 1px dotted green;"); + targetIframe.addEventListener("load", init2); + document.body.appendChild(targetIframe); +} + +function init2() +{ + targetWindow = targetIframe.contentWindow; + targetDocument = targetWindow.document; + + p = document.getElementById("p"); + pText = p.firstChild; + + targetDocument.body.appendChild(targetDocument.adoptNode(p, true)); + + targetDocument.designMode = 'on'; + + setTimeout(boom, 0); +} + +function boom() +{ + var rng = targetDocument.createRange(); + rng.setStart(pText, 3); + rng.setEnd(pText, 3); + + targetWindow.getSelection().addRange(rng); + + targetDocument.execCommand("insertorderedlist", false, null); + + document.documentElement.removeAttribute("class") +} +</script> +</head> + +<body onload="init1();"> +<p id="p">word word</p> +</body> + +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertparagraph-from-DOMNodeInserted-caused-by-insertorderedlist.html b/testing/web-platform/tests/editing/crashtests/insertparagraph-from-DOMNodeInserted-caused-by-insertorderedlist.html new file mode 100644 index 0000000000..fa322420cb --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertparagraph-from-DOMNodeInserted-caused-by-insertorderedlist.html @@ -0,0 +1,23 @@ +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + document.addEventListener("DOMNodeInserted", x); + + function x() + { + document.removeEventListener("DOMNodeInserted", x); + document.execCommand("insertParagraph", false, ""); + } + + document.execCommand("insertorderedlist", false, ""); +} + +</script> +</head> + +<body contenteditable="true" onload="boom()"></body> + +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertparagraph-in-map-element-editing-host.html b/testing/web-platform/tests/editing/crashtests/insertparagraph-in-map-element-editing-host.html new file mode 100644 index 0000000000..e05b36907e --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertparagraph-in-map-element-editing-host.html @@ -0,0 +1,12 @@ +<!DOCTYPE html> +<meta charset="utf-8"> +<script> + document.addEventListener("DOMContentLoaded", () => { + document.getElementById("id_0").contentEditable = false; + document.querySelector("[contenteditable]").focus(); + document.execCommand("insertParagraph"); + }) +</script> +<pre> +<ins id="id_0"> +<map contenteditable>
\ No newline at end of file diff --git a/testing/web-platform/tests/editing/crashtests/inserttext-at-start-with-different-style.html b/testing/web-platform/tests/editing/crashtests/inserttext-at-start-with-different-style.html new file mode 100644 index 0000000000..ddd19aafd4 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserttext-at-start-with-different-style.html @@ -0,0 +1,20 @@ +<html> +<head> +<meta charset="utf-8"> +<head> +<script> +function go() { + a.show(); + document.execCommand("bold", false); + b.style.setProperty("font", "0px/43%"); + document.execCommand("insertText", false, "a"); +} +</script> +</head> +<body onload=go()> +<ul contenteditable="true"> +<li id="b" style="font-weight: bolder">a</li> +<dialog id="a" tabindex="0">a</dialog> +</ul> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-inline-editing-host.html b/testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-inline-editing-host.html new file mode 100644 index 0000000000..74b0993322 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-inline-editing-host.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<title>Test for bug 615015 of Mozilla</title> +<script> +function boom() +{ + document.getElementById("j").focus(); + try { + document.execCommand("insertunorderedlist", false, null); + } catch(e) { } +} +</script> +</head> +<body onload="boom();"><span><span contenteditable id="j"></span>T</span></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-table-editing-host.html b/testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-table-editing-host.html new file mode 100644 index 0000000000..19cc205b91 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-table-editing-host.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + var table = document.createElement("table"); + document.body.appendChild(table); + table.contentEditable = "true"; + table.focus(); + try { + // This will throw, since it's attempting to inject a list inside a table + document.execCommand("insertunorderedlist", false, null); + } catch (e) {} +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/justifycenter-around-textarea.html b/testing/web-platform/tests/editing/crashtests/justifycenter-around-textarea.html new file mode 100644 index 0000000000..71d24f37b4 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/justifycenter-around-textarea.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<meta charset="utf-8"> +<script> +function go() { + a.replaceWith(undefined) + window.getSelection().modify("move", "right", "word") + document.execCommand("justifyCenter", false) +} +</script> +<div contenteditable="true">a</div> +<textarea>23</textarea> +<li dir="RTL"> +<strong id="a"> +<svg onload="go()"> diff --git a/testing/web-platform/tests/editing/crashtests/justifycenter-then-delete-selection-on-DOMSubtreeModified.html b/testing/web-platform/tests/editing/crashtests/justifycenter-then-delete-selection-on-DOMSubtreeModified.html new file mode 100644 index 0000000000..1ee9ac35cb --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/justifycenter-then-delete-selection-on-DOMSubtreeModified.html @@ -0,0 +1,24 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + document.execCommand("selectAll"); + document.querySelector("li").addEventListener("DOMSubtreeModified", () => { + document.designMode = "on"; + document.execCommand("justifyCenter"); + getSelection().deleteFromDocument(); + }); + document.querySelector("li").type = "1"; +}); +</script> +</head> +<body> +<li> + <h3 align="right"> + <option contenteditable="true"></option> + </h3> +</li> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/justifyfull-selection-containing-non-editable-div-and-everything-styled-white-space-break-space.html b/testing/web-platform/tests/editing/crashtests/justifyfull-selection-containing-non-editable-div-and-everything-styled-white-space-break-space.html new file mode 100644 index 0000000000..cf199fa087 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/justifyfull-selection-containing-non-editable-div-and-everything-styled-white-space-break-space.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> + <style> + * { + white-space: break-spaces ! important; + } + </style> + <script> + window.addEventListener('load', () => { + document.documentElement.contentEditable = true + document.execCommand('selectAll', false, null) + document.execCommand('justifyFull', false, null) + }) + </script> +</head> +<div contenteditable='false'></div> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/loading-different-page-in-iframe-while-iframe-sets-spellcheck-attr-from-load.html b/testing/web-platform/tests/editing/crashtests/loading-different-page-in-iframe-while-iframe-sets-spellcheck-attr-from-load.html new file mode 100644 index 0000000000..afddac34e1 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/loading-different-page-in-iframe-while-iframe-sets-spellcheck-attr-from-load.html @@ -0,0 +1,13 @@ +<html> +<head> +<script> +function crash() { + document.querySelector("iframe").onload = null; + document.querySelector("iframe").srcdoc = "2nd page"; +} +</script> +</head> +<body onload="crash()"> + <iframe srcdoc="<html><body onload=$quot;document.body.setAttribute('spellcheck', true);$quot;></body></html>"></iframe> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/make-editable-div-inline-and-set-contenteditable-of-input-to-false.html b/testing/web-platform/tests/editing/crashtests/make-editable-div-inline-and-set-contenteditable-of-input-to-false.html new file mode 100644 index 0000000000..1743a2641d --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/make-editable-div-inline-and-set-contenteditable-of-input-to-false.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html class="test-wait"> +<head> +<meta charset="utf-8"> +<title>Testcase for bug 650572 of Mozilla</title> +<script> +function boom() +{ + document.documentElement.offsetHeight; + document.body.focus(); + document.querySelector("div").style.display = "inline"; + document.querySelector("input").contentEditable = "false"; + document.documentElement.removeAttribute("class"); +} +</script> +</head> +<body contenteditable="true" onload="setTimeout(boom, 200);"><div><input></div></body> +</html> + diff --git a/testing/web-platform/tests/editing/crashtests/make-parent-element-editable-after-making-focused-editing-host-non-editable.html b/testing/web-platform/tests/editing/crashtests/make-parent-element-editable-after-making-focused-editing-host-non-editable.html new file mode 100644 index 0000000000..d624d7d3b9 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/make-parent-element-editable-after-making-focused-editing-host-non-editable.html @@ -0,0 +1,21 @@ +<html> +<head> +<script> +function boom() +{ + document.getElementById("div").contentEditable = "true"; + document.getElementById("div").focus(); + document.getElementById("div").contentEditable = "false"; + + document.getElementById("table").contentEditable = "true"; +} +</script> +</head> + +<body onload="boom();"> + +<table id="table"><td></td></table><div id="div"></div> + +</body> + +</html> diff --git a/testing/web-platform/tests/editing/crashtests/move-editing-host-to-subdocument-when-textarea-has-focus.html b/testing/web-platform/tests/editing/crashtests/move-editing-host-to-subdocument-when-textarea-has-focus.html new file mode 100644 index 0000000000..b7d2e2f902 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/move-editing-host-to-subdocument-when-textarea-has-focus.html @@ -0,0 +1,15 @@ +<script> +addEventListener("DOMContentLoaded", () => { + document.querySelector("iframe").contentDocument.body.appendChild( + document.querySelector("span") + ); + document.documentElement.style.display = "none"; +}) +</script> +<hgroup> +<audio controls> +</audio> +<iframe></iframe> +<span contenteditable></span> +</hgroup> +<textarea autofocus> diff --git a/testing/web-platform/tests/editing/crashtests/move-first-element-from-editinghost-to-outside-on-input-of-embolden.html b/testing/web-platform/tests/editing/crashtests/move-first-element-from-editinghost-to-outside-on-input-of-embolden.html new file mode 100644 index 0000000000..6bb87c2810 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/move-first-element-from-editinghost-to-outside-on-input-of-embolden.html @@ -0,0 +1,22 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + document.querySelector("ol").addEventListener("input", () => { + const inlineEditingHost = document.querySelector("span[contenteditable]"); + const iter = document.createNodeIterator(inlineEditingHost, NodeFilter.SHOW_ELEMENT); + iter.nextNode().before(inlineEditingHost); + }); + document.execCommand("selectAll"); + document.execCommand("bold"); +}); +</script> +</head> +<body> +<ol> +<span contenteditable> +<h6></h6> +</span></ol></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/move-legend-followed-by-textarea-into-orphan-div.html b/testing/web-platform/tests/editing/crashtests/move-legend-followed-by-textarea-into-orphan-div.html new file mode 100644 index 0000000000..462ff37fd6 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/move-legend-followed-by-textarea-into-orphan-div.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<title>Testcase for bug 667321 of Mozilla</title> +<script> +function boom() +{ + document.body.style.float = "left"; + document.createElement("div").appendChild(document.querySelector("legend")); +} +</script> +</head> +<body onload="boom();"><fieldset><legend></legend><textarea></textarea></fieldset></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/multiple-execCommand-calls-after-interting-long-text.html b/testing/web-platform/tests/editing/crashtests/multiple-execCommand-calls-after-interting-long-text.html new file mode 100644 index 0000000000..32d0e38248 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/multiple-execCommand-calls-after-interting-long-text.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<title>Testcase for bug 682650 of Mozilla</title> +<script> +function boom() { + document.documentElement.contentEditable = "true"; + document.execCommand("inserthtml", false, "<button><\/button>"); + document.execCommand("inserthtml", false, "i".repeat(34646)); + document.execCommand("contentReadOnly", false, null); + document.execCommand("removeformat", false, null); + document.execCommand("hilitecolor", false, "red"); + document.execCommand("inserthtml", false, "a"); + document.execCommand("delete", false, null); +} +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/non-root-editable-html-element.html b/testing/web-platform/tests/editing/crashtests/non-root-editable-html-element.html new file mode 100644 index 0000000000..2e4c02b0e1 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/non-root-editable-html-element.html @@ -0,0 +1,7 @@ +<span> +<script contenteditable="true"></script> +<blockquote> +<input> +<code style="display: table-row;"> +<html contenteditable="true"> +</blockquote> diff --git a/testing/web-platform/tests/editing/crashtests/normalize_document_at_DOMSubtreeModified_during_insertparagraph.html b/testing/web-platform/tests/editing/crashtests/normalize_document_at_DOMSubtreeModified_during_insertparagraph.html new file mode 100644 index 0000000000..a8cbaf7217 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/normalize_document_at_DOMSubtreeModified_during_insertparagraph.html @@ -0,0 +1,16 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + document.documentElement.innerHTML = "<main>\n>"; + document.addEventListener("DOMSubtreeModified", () => { + document.normalize(); + }, {capture: true}); + document.designMode = "on" + document.execCommand("insertParagraph"); +}); +</script> +</head> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/outdent-across-svg-boundary.html b/testing/web-platform/tests/editing/crashtests/outdent-across-svg-boundary.html new file mode 100644 index 0000000000..f652a2e237 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/outdent-across-svg-boundary.html @@ -0,0 +1,38 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="test-wait"> +<head> +<script> +function init() +{ + var targetWindow = window.frames[0]; + var targetDocument = targetWindow.document; + var rootish = document.getElementById('rootish'); + + targetDocument.body.appendChild(targetDocument.adoptNode(rootish)); + targetDocument.designMode = 'on'; + + targetWindow.getSelection().removeAllRanges(); + + var r = targetDocument.createRange(); + r.setStart(targetDocument.getElementById("start"), 0); + r.setEnd(targetDocument.getElementById("endparent").firstChild, 0); + targetWindow.getSelection().addRange(r); + + targetDocument.execCommand('outdent', false, null); + document.documentElement.removeAttribute("class"); +} +</script> + +</head> + +<body onload="setTimeout(init, 300);"> + +<iframe srcdoc="" style="width: 95%; height: 500px;"></iframe> + +<div id="rootish"> + <div id="start"></div> + <p>Huh</p> + <svg xmlns="http://www.w3.org/2000/svg" id="endparent"> </svg> +</div> + +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/outdent-editing-host-containing-combining-diacritical-mark.html b/testing/web-platform/tests/editing/crashtests/outdent-editing-host-containing-combining-diacritical-mark.html new file mode 100644 index 0000000000..0ed71f789b --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/outdent-editing-host-containing-combining-diacritical-mark.html @@ -0,0 +1,16 @@ +<html class="test-wait"> +<head> +<meta charset="utf-8"> +<title>Test for bug 499844 of Mozilla</title> +<script> +function boom() +{ + document.body.contentEditable = "true"; + getSelection().collapse(document.body.firstChild, 0); + document.execCommand("outdent"); + document.documentElement.removeAttribute("class"); +} +</script> +</head> +<body style="word-spacing: 3px;" onload="boom();"> ́</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/outdent-in-empty-body-editing-host.html b/testing/web-platform/tests/editing/crashtests/outdent-in-empty-body-editing-host.html new file mode 100644 index 0000000000..f68e46bc53 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/outdent-in-empty-body-editing-host.html @@ -0,0 +1,7 @@ +<html> +<head> +</head> +<body style="margin: initial;" + contenteditable="true" + onload="document.execCommand('outdent', false, null);"></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/outdent-indent-inserthorizontalrule-on-selectionchange.html b/testing/web-platform/tests/editing/crashtests/outdent-indent-inserthorizontalrule-on-selectionchange.html new file mode 100644 index 0000000000..800d9d1969 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/outdent-indent-inserthorizontalrule-on-selectionchange.html @@ -0,0 +1,23 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +var count = 0; +document.addEventListener("DOMContentLoaded", () => { + document.onselectionchange = () => { + document.execCommand("outdent"); + document.execCommand("indent"); + document.execCommand("insertHorizontalRule"); + if (count++ == 10) { + document.onselectionchange = null; + } + }; + find("A"); +}); +</script> +</head> +<body><isindex contenteditable> +A +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html b/testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html new file mode 100644 index 0000000000..6cf2524a54 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html @@ -0,0 +1,73 @@ +<!DOCTYPE HTML> +<html><head> + <meta charset="iso-8859-1"> + <title>Testcase for bug 448329 of Mozilla</title> +</head> +<body> + +<iframe id="frame448329"></iframe> + +<script> + +function test448329(id,cmd) { + var elm = document.getElementById(id); + var doc = elm.contentDocument; + doc.designMode = "On"; + + doc.body.offsetWidth; + var selection = doc.defaultView.getSelection(); + + // Test document node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + var range = doc.createRange(); + range.setStart(doc, 0); + range.setEnd(doc, 0); + selection.addRange(range); + doc.queryCommandIndeterm(cmd); + + // Test HTML node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + range = doc.createRange(); + range.setStart(doc.documentElement, 0); + range.setEnd(doc.documentElement, 0); + selection.addRange(range); + doc.queryCommandIndeterm(cmd); + + // Test BODY node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + range = doc.createRange(); + var body = doc.documentElement.childNodes[1]; + range.setStart(body, 0); + range.setEnd(body, 0); + selection.addRange(range); + doc.queryCommandIndeterm(cmd); + + var text = doc.createTextNode("Hello there"); + body.insertBefore(text, null) + + // Test TEXT node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + range = doc.createRange(); + range.setStart(text, 0); + range.setEnd(text, 1); + selection.addRange(range); + doc.queryCommandIndeterm(cmd); + +} + +test448329("frame448329", "backcolor") +test448329("frame448329", "hilitecolor") + +</script> + + +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-in-empty-iframe-in-designMode-from-load.html b/testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-in-empty-iframe-in-designMode-from-load.html new file mode 100644 index 0000000000..74d80e19b3 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-in-empty-iframe-in-designMode-from-load.html @@ -0,0 +1,21 @@ +<html> +<head> + <title>Testcase for bug 448329 of Mozilla</title> +<script> +function go() { + test("myFrame", "backcolor"); +} +function test(id,cmd) { + var doc = document.getElementById(id).contentDocument; + doc.designMode = "On"; + + var selection = doc.defaultView.getSelection(); + selection.removeAllRanges(); + selection.addRange(doc.createRange()); + + doc.queryCommandIndeterm(cmd); +} +</script> +</head> +<body onload="go()"><iframe id="myFrame"></iframe></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/queryCommandState-backcolor-after-removing-html-element-in-designMode-from-load.html b/testing/web-platform/tests/editing/crashtests/queryCommandState-backcolor-after-removing-html-element-in-designMode-from-load.html new file mode 100644 index 0000000000..1c8fe5db9b --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/queryCommandState-backcolor-after-removing-html-element-in-designMode-from-load.html @@ -0,0 +1,8 @@ +<html> +<BODY onload=" +document.designMode='on'; +document.removeChild(document.firstChild); +document.queryCommandState('BackColor'); +"> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/queryCommandValue-backcolor-after-replacing-html-element-with-new-one-in-designMode-from-load.html b/testing/web-platform/tests/editing/crashtests/queryCommandValue-backcolor-after-replacing-html-element-with-new-one-in-designMode-from-load.html new file mode 100644 index 0000000000..d14422c931 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/queryCommandValue-backcolor-after-replacing-html-element-with-new-one-in-designMode-from-load.html @@ -0,0 +1,8 @@ +<html> +<BODY onload=" +document.designMode='on'; +document.replaceChild(document.createElement('HTML'), document.firstChild); +document.queryCommandValue('backcolor'); +"> +</body> +</html>
\ No newline at end of file diff --git a/testing/web-platform/tests/editing/crashtests/remove-document-element-of-iframe-having-style-content.html b/testing/web-platform/tests/editing/crashtests/remove-document-element-of-iframe-having-style-content.html new file mode 100644 index 0000000000..b032311fa7 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/remove-document-element-of-iframe-having-style-content.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<title>Testcase for bug 643706 of Mozilla</title> +<script> +function boom() { + const iframe = document.querySelector("iframe"); + const win = iframe.contentWindow; + win.document.designMode = 'on'; + iframe.style.content = "'m'"; + win.document.removeChild(win.document.documentElement) +} +</script> +</head> +<body onload="boom();"><iframe srcdoc=""></iframe></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/remove-editing-host-on-DOMNodeInserted-at-indent.html b/testing/web-platform/tests/editing/crashtests/remove-editing-host-on-DOMNodeInserted-at-indent.html new file mode 100644 index 0000000000..22e8fd0713 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/remove-editing-host-on-DOMNodeInserted-at-indent.html @@ -0,0 +1,24 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + const editingHost = document.querySelector("h6[contenteditable]"); + document.querySelector("wbr").addEventListener( + "DOMNodeInserted", + () => editingHost.remove() + ); + window.find("A"); + document.execCommand("indent"); +}) +</script> +</head> +<body> +<h6 contenteditable> +<time> +<wbr> +<main></main> +A +</time></h6></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/remove-editing-host-which-is-selected.html b/testing/web-platform/tests/editing/crashtests/remove-editing-host-which-is-selected.html new file mode 100644 index 0000000000..06ee6dc505 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/remove-editing-host-which-is-selected.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<meta charset="utf-8"> +<script> +window.onload = () => { + let s = window.getSelection() + let r = document.createRange() + r.selectNode(document.getElementById('b')) + s.addRange(r) + r = document.createRange() + r.selectNode(document.getElementById('a')) + s.addRange(r) + document.documentElement.innerHTML = '' +} +</script> +<body id='a' contenteditable='true'> +<canvas tabindex='0'> +<audio id='b'> diff --git a/testing/web-platform/tests/editing/crashtests/remove-iframe-for-designMode.html b/testing/web-platform/tests/editing/crashtests/remove-iframe-for-designMode.html new file mode 100644 index 0000000000..609a9ca542 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/remove-iframe-for-designMode.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<title>Test for bug 612565 of Mozilla</title> +</head> + <body> + <iframe></iframe> + </body> + <script> + onload = function() { + var i = document.querySelector("iframe"); + var doc = i.contentDocument; + doc.body.appendChild(doc.createTextNode("foo")); + doc.designMode = "on"; + while (doc.body.firstChild) { + doc.body.firstChild.remove(); + } + }; + </script> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/remove-right-block-during-joining-with-parent-left-block.html b/testing/web-platform/tests/editing/crashtests/remove-right-block-during-joining-with-parent-left-block.html new file mode 100644 index 0000000000..29ee228fea --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/remove-right-block-during-joining-with-parent-left-block.html @@ -0,0 +1,33 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<title>Test removing right block while joining it and parent left block</title> +<script> +addEventListener("load", () => { + const editingHosts = document.querySelectorAll("div[contenteditable]"); + for (const editingHost of editingHosts) { + editingHost.focus(); + const rightChildBlock = editingHost.querySelector("div > div > div"); + getSelection().collapse(rightChildBlock.firstChild.firstChild, 0); + editingHost.addEventListener("DOMSubtreeModified", () => { + document.body.appendChild(rightChildBlock); + }); + document.execCommand("delete"); + } +}); +</script> +</head> +<body> + <div contenteditable> + <div>parent<div><b>child</b></div>parent</div> + </div> + <div contenteditable> + <div>parent<div><b>child<br>2nd line</b></div>parent</div> + </div> + <div contenteditable style="white-space:pre"> + <div>parent<div>child +2nd line</div>parent</div> + </div> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/remve-documentElement-after-inserthtml-svg-and-td.html b/testing/web-platform/tests/editing/crashtests/remve-documentElement-after-inserthtml-svg-and-td.html new file mode 100644 index 0000000000..eebeac317d --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/remve-documentElement-after-inserthtml-svg-and-td.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + document.querySelector("div[contenteditable]").focus(); + document.execCommand("inserthtml", false, "<svg><td>"); + document.documentElement.remove(); +}); +</script> +</head> + +<body><div contenteditable></div></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/replace-parent-of-editing-host-on-DOMSubtreeModified.html b/testing/web-platform/tests/editing/crashtests/replace-parent-of-editing-host-on-DOMSubtreeModified.html new file mode 100644 index 0000000000..9d431aa860 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/replace-parent-of-editing-host-on-DOMSubtreeModified.html @@ -0,0 +1,28 @@ +<!doctype html> +<html> +<head> +<script> +document.addEventListener("DOMContentLoaded", () => { + getSelection().collapse(document.querySelector("content"), 1); + document.querySelector("div[contenteditable]").addEventListener("DOMSubtreeModified", () => { + document.querySelector("tr").replaceChild( + document.querySelector("meter"), + document.querySelector("th") + ); + }); + document.execCommand("justifyFull"); +}); +</script> +</head> +<body> +<table> +<tr> +<th> +<div contenteditable> +<meter> +<content> +<ul></ul> +</div> +</th></tr></table> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/selectall-and-inerthtml-in-textarea-editing-host.html b/testing/web-platform/tests/editing/crashtests/selectall-and-inerthtml-in-textarea-editing-host.html new file mode 100644 index 0000000000..8b0e36cd65 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/selectall-and-inerthtml-in-textarea-editing-host.html @@ -0,0 +1,15 @@ +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + document.execCommand("selectAll", false, null); + document.execCommand("inserthtml", false, "<p>"); +} + +</script> +</head> + +<body onload="boom();"><textarea contenteditable="true"></textarea></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/selectall-in-head-editing-host-after-body-removed.html b/testing/web-platform/tests/editing/crashtests/selectall-in-head-editing-host-after-body-removed.html new file mode 100644 index 0000000000..786ea25d9a --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/selectall-in-head-editing-host-after-body-removed.html @@ -0,0 +1,19 @@ +<html><head><script type="text/javascript"> + +function boom() +{ + var dE = document.documentElement; + var head = document.getElementsByTagName("head")[0]; + dE.removeChild(document.body); + dE.contentEditable = "true"; + dE.focus(); + dE.contentEditable = "false"; + head.focus(); + head.contentEditable = "true"; + try { + document.execCommand("selectAll", false, ""); + } catch(e) { + } +} + +</script></head><body onload="boom();"></body></html>
\ No newline at end of file diff --git a/testing/web-platform/tests/editing/crashtests/selectall-selection-modify-move-forward-lineboundary-selectall-around-editable-canvas.html b/testing/web-platform/tests/editing/crashtests/selectall-selection-modify-move-forward-lineboundary-selectall-around-editable-canvas.html new file mode 100644 index 0000000000..8e57700af5 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/selectall-selection-modify-move-forward-lineboundary-selectall-around-editable-canvas.html @@ -0,0 +1,12 @@ +<!DOCTYPE html> +<meta charset="utf-8"> +<script> +onload = () => { + document.querySelector("canvas[contenteditable]").blur(); + document.execCommand("selectAll", false); + getSelection().modify("move", "forward", "lineboundary"); + document.execCommand("selectAll", false); +}; +</script> +<canvas contenteditable="true"> +<audio controls> diff --git a/testing/web-platform/tests/editing/crashtests/selection-modify-around-input-in-contenteditable.html b/testing/web-platform/tests/editing/crashtests/selection-modify-around-input-in-contenteditable.html new file mode 100644 index 0000000000..90b615da5c --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/selection-modify-around-input-in-contenteditable.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + const selection = window.getSelection(); + const range = selection.getRangeAt(0); + selection.modify("move", "backward", "character"); + selection.addRange(range); +}); +</script> +</head> +<body> +<fieldset contenteditable spellcheck="true"> + <input value="x"> + <table> + <caption></caption> + </table> +</fieldset> +</body> +</html>
\ No newline at end of file diff --git a/testing/web-platform/tests/editing/crashtests/selection-modify-extend-backward-character-to-outside-body-in-designMode.html b/testing/web-platform/tests/editing/crashtests/selection-modify-extend-backward-character-to-outside-body-in-designMode.html new file mode 100644 index 0000000000..9f465cc462 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/selection-modify-extend-backward-character-to-outside-body-in-designMode.html @@ -0,0 +1,10 @@ +<!DOCTYPE html> +<meta charset="utf-8"> +<script> +onload = () => { + document.designMode = 'on'; + getSelection().selectAllChildren(document.body); + getSelection().modify('extend', 'backward', 'character'); +}; +</script> +<audio controls> diff --git a/testing/web-platform/tests/editing/crashtests/support/unloading-editor-in-subdocument-containing-misspelled-word-iframe.html b/testing/web-platform/tests/editing/crashtests/support/unloading-editor-in-subdocument-containing-misspelled-word-iframe.html new file mode 100644 index 0000000000..cfedfa8d2e --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/support/unloading-editor-in-subdocument-containing-misspelled-word-iframe.html @@ -0,0 +1 @@ +<html><meta charset="utf-8"><body><textarea>notaword</textarea></body></html> diff --git a/testing/web-platform/tests/editing/crashtests/textarea-will-be-blurred-by-focus-event-listener.html b/testing/web-platform/tests/editing/crashtests/textarea-will-be-blurred-by-focus-event-listener.html new file mode 100644 index 0000000000..bcb145c309 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/textarea-will-be-blurred-by-focus-event-listener.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html class="test-wait"> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + const textarea = document.querySelector("textarea"); + textarea.addEventListener("focus", () => { + textarea.select(); + textarea.parentElement.setAttribute("hidden", "hidden"); + setTimeout(() => document.documentElement.removeAttribute("class"), 0); + }); + textarea.focus(); +}); +</script> +<div><textarea>abc</textarea></div> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/unloading-editor-in-subdocument-containing-misspelled-word.html b/testing/web-platform/tests/editing/crashtests/unloading-editor-in-subdocument-containing-misspelled-word.html new file mode 100644 index 0000000000..1b90e1d56a --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/unloading-editor-in-subdocument-containing-misspelled-word.html @@ -0,0 +1,11 @@ +<html class="test-wait"> +<head> +<meta charset="utf-8"> +<title>Test case for bug 459613 of Mozilla</title> +</head> +<body> +<iframe + srcdoc="support/unloading-editor-in-subdocument-containing-misspelled-word-iframe.html" + onload="document.documentElement.removeAttribute('class')"></iframe> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/update-dom-during-undoing-in-textarea.html b/testing/web-platform/tests/editing/crashtests/update-dom-during-undoing-in-textarea.html new file mode 100644 index 0000000000..56f7f82a21 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/update-dom-during-undoing-in-textarea.html @@ -0,0 +1,32 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<title>Test for updating the DOM tree while execCommand("undo") is running in the textarea</title> +<script> +"use strict"; + +let count = 0; +addEventListener("load", () => { + document.execCommand("insertText", false, "F"); + document.execCommand("undo"); +}); + +function onInputOfTextarea() { + if (count) { + document.querySelector("base").appendChild( + document.querySelector("content") + ); + } + count++; +} +</script> +</head> +<body> +<iframe></iframe> +<textarea autofocus oninput="onInputOfTextarea()">a</textarea> +<base></base> +<content> +<menu> +</body> +</html> |