summaryrefslogtreecommitdiffstats
path: root/editor/libeditor/crashtests/1375131.html
blob: 4060cf3d4c60a011065cd7c17f604e877e0b58d8 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
<!DOCTYPE html>
<html>
  <head>
    <script type="application/javascript">
      document.designMode = 'on';

      let div = document.createElement('div');
      let p = document.createElement('p');
      document.documentElement.appendChild(div);
      document.documentElement.appendChild(
        document.createElement('body'));
      document.documentElement.appendChild(p);
      document.execCommand('insertimage', false, 'http://localhost/');
      document.execCommand('insertparagraph', false, null);

      document.elementFromPoint(0, 0);

      let selection = window.getSelection();
      selection.modify('extend', 'forward', 'character');

      let range = document.createRange();
      range.selectNode(p);
      selection.addRange(range);
      range.setStart(div, 0);

      range = document.createRange();
      range.selectNode(p);
      selection.addRange(range);

      document.execCommand('delete', false, null);
    </script>
  </head>
</html>