| <!DOCTYPE html> |
| <!-- It is a minimized testcase for a Clusterfuzz test. See crbug.com/345373 --> |
| <html> |
| <head> |
| <style> |
| * { float:left; } |
| .class0 { content: url(); } |
| </style> |
| </head> |
| <body> |
| <ul class="class0"> |
| <li id="r0"></li> |
| <li id="r1"></li> |
| </ul> |
| <hr/> |
| <script> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| |
| var domNodeRemovedFireCount = 0; |
| document.addEventListener("DOMNodeRemoved", function () { |
| if (domNodeRemovedFireCount >= 1) |
| return; |
| domNodeRemovedFireCount++; |
| var element = event.srcElement; |
| document.execCommand('InsertOrderedList', false, false); |
| |
| var parentElement = document.getElementById('r1'); |
| var childElement = parentElement.childNodes[0]; |
| parentElement.insertBefore(element, childElement); |
| |
| document.execCommand('Undo', false, false); |
| document.execCommand('Redo', false, false); |
| document.execCommand('Outdent', false, false); |
| }, false); |
| |
| document.designMode = 'on'; |
| var selection = window.getSelection(); |
| document.execCommand('SelectAll', false); |
| var range = selection.getRangeAt(0); |
| var insertedElement = document.getElementById('r0'); |
| range.insertNode(insertedElement); |
| document.write('This test passes if the page does not crash.'); |
| </script> |
| </body> |
| </html> |
