summaryrefslogtreecommitdiffstats
path: root/editor/libeditor/crashtests/1648564.html
blob: f82ec3d8e61d2e9ee74f69eeba283be80e97f23f (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
<script>
window.addEventListener('load', () => {
  // For emulating the traditional behavior, collapse Selection to end of the
  // <body> (at the comment node).
  getSelection().collapse(document.body, document.body.childNodes.length);
  const map = document.querySelector("map");
  const anchor = document.querySelector("a");
  map.replaceChild(
    anchor,
    map.childNodes[(2828994049 % map.childNodes.length)]
  );
  anchor.innerHTML = "<o>";
  getSelection().setBaseAndExtent(
    document,
    (2019424593 % document.childNodes.length),
    document.documentElement,
    (3503355750 % document.documentElement.childNodes.length)
  );
  document.designMode = "on";
  document.execCommand("forwardDelete");
  document.execCommand("forwardDelete");
});
</script>
<sub contenteditable>
<map>
<address></address>
<a>
</a>
<!-- COMMENT --></body>