33 lines
1.2 KiB
HTML
33 lines
1.2 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<script>
|
|
// This test uses a weired textarea to reproduce the issue. The condition of a crash is very sensitive to HTML.
|
|
// If we add a new-line at EOF or add other tags in <body> part, the crash will be unlikely to happen.
|
|
// For example, if we move this comment to the actual HTML or try to load 'js-test-pre.js', the crash won't happen.
|
|
//
|
|
// * Mutation events should not be dispatched on this case. This bug is being tracked by webkit bug https://bugs.webkit.org/show_bug.cgi?id=87372
|
|
// * ... And Mutation events are no longer fired. See https://bugs.webkit.org/show_bug.cgi?id=93427.
|
|
// We would keep this test just for preventing regression.
|
|
if (window.testRunner) {
|
|
testRunner.dumpAsText();
|
|
testRunner.waitUntilDone();
|
|
}
|
|
|
|
function attackAndFinish() {
|
|
document.designMode = "on";
|
|
document.execCommand("SelectAll");
|
|
document.execCommand("Delete");
|
|
document.body.offsetLeft;
|
|
document.body.innerHTML = 'Test passes if a DOMCharacterModified event on the textarea does not crash.';
|
|
if (window.testRunner)
|
|
testRunner.notifyDone();
|
|
}
|
|
|
|
document.addEventListener("DOMCharacterDataModified", attackAndFinish);
|
|
|
|
window.setTimeout(attackAndFinish, 10);
|
|
</script>
|
|
</head>
|
|
<textarea> <
|