| <!DOCTYPE html> |
| <html> |
| <head> |
| <script> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| |
| onload = function() { |
| // Insert "body" element into "div" element. Simple repetition of "body" |
| // element or renaming "body" to "div" doesn't reproduce bug. |
| var targetNode = document.getElementById('target'); |
| targetNode.appendChild(document.body.cloneNode(true)); |
| |
| document.designMode = 'on'; |
| document.execCommand('SelectAll'); |
| document.execCommand('JustifyRight'); |
| document.body.textContent = 'PASS if Blink doesn\'t crash.'; |
| }; |
| </script> |
| </head> |
| <body> |
| <textarea></textarea> |
| <span></span> |
| <div id="target" style="display:inline-table">foo</div> |
| </body> |
| </html> |
