summaryrefslogtreecommitdiffstats
path: root/editor/libeditor/crashtests/1405747.html
blob: dae3a130f0daa5f28ea929db1cb47c44a88199db (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
<script>
let th;
function onLoad() {
  // For emulating the traditional behavior, collapse Selection to end of the
  // <colgroup> which is the last child of the <body>.
  getSelection().collapse(
    document.querySelector("colgroup"),
    document.querySelector("colgroup").childNodes.length
  );
  th = document.querySelector("th"); // Cache the target for removing the event handler.
  try {
    th.addEventListener("DOMSubtreeModified", onDOMSubtreeModified);
  } catch(e) {}
  try {
    th.align = "";
  } catch(e) {}
}

let count = 0;
function onDOMSubtreeModified() {
  if (count++ == 1) {
    // If we didn't stop testing this, this event handler would be called too
    // many times.  It's enough to run twice to reproduce the bug report.
    th.removeEventListener("DOMSubtreeModified", onDOMSubtreeModified);
  }
  try {
    document.execCommand("selectAll");
  } catch(e) {}
  try {
    document.execCommand("justifyCenter");
  } catch(e) {}
  try {
    document.execCommand("forwardDelete");
  } catch(e) {}
}
</script>
<body onload="onLoad()">
<table contenteditable>
<th></th>
<colgroup></body>