LayoutTests/accessibility/textbox-role-on-contenteditable-crash.html - WebKit - Git at Google

 <!DOCTYPE html>
 <html>
 <body>
 <p>This tests a crashing scenario where an element with a textbox role attribute which also contenteditable has its content changed.</p>
 <div id="textbox" role="textbox" aria-multiline="true" contenteditable="true" tabindex="0">
 Textbox content.
 </div>

 <script>

 if (window.accessibilityController) {
     testRunner.dumpAsText();
     var textbox = document.getElementById("textbox");
     textbox.focus();
     var textboxAXElement = accessibilityController.focusedElement;

     getSelection().setBaseAndExtent(textbox.firstChild, 0, textbox.firstChild, 0);

     // This should not crash.
     document.execCommand("InsertParagraph");

     document.write("PASS");
 }

 </script>
 </body>
 </html>
	<!DOCTYPE html>
	<html>
	<body>
	<p>This tests a crashing scenario where an element with a textbox role attribute which also contenteditable has its content changed.</p>
	<div id="textbox" role="textbox" aria-multiline="true" contenteditable="true" tabindex="0">
	Textbox content.
	</div>

	<script>

	if (window.accessibilityController) {
	testRunner.dumpAsText();
	var textbox = document.getElementById("textbox");
	textbox.focus();
	var textboxAXElement = accessibilityController.focusedElement;

	getSelection().setBaseAndExtent(textbox.firstChild, 0, textbox.firstChild, 0);

	// This should not crash.
	document.execCommand("InsertParagraph");

	document.write("PASS");
	}

	</script>
	</body>
	</html>