<!DOCTYPE html>
<html>
<body>
This test verifies that deleting DOM elements in a DOMSubtreeModified handler triggered by and execCommand('bold') does not produce a crash.
<div id="test" contenteditable style="border: 1px solid red">
<b class="x" id="inlined">
    <u></u>
    x
</b>
</div>
<script>
function treeModifiedHandler()
{
    document.removeEventListener("DOMSubtreeModified", treeModifiedHandler, false);

    var b = document.getElementById("inlined");
    b.insertBefore(document.createTextNode("test"), b.firstChild);

    var range = document.createRange();
    range.setStart(b,0);
    range.setEnd(b,2);
    range.deleteContents();
    document.body.appendChild(document.createTextNode("PASS"));
}

function runtest()
{
    var test = document.getElementById('test');
    window.getSelection().selectAllChildren(test);

    document.execCommand('bold', false, null);
    document.addEventListener("DOMSubtreeModified", treeModifiedHandler, false);
    document.execCommand('bold', false, null);
}

if (window.testRunner)
    testRunner.dumpAsText();

runtest();
</script>
</body>
</html>