LayoutTests/fast/lists/crash-when-list-marker-is-moved-during-selection.html - WebKit - Git at Google

 <!DOCTYPE html>
 <html>
 <head>
 <title>This tests that we don't mutate the render tree during selection.</title>
 <style>
   body {
     column-count: 2;
   }
 </style>
 <script>
   if (window.testRunner) {
     testRunner.dumpAsText();
     testRunner.waitUntilDone();
   }

   function runTest() {
     setTimeout(function() {
       li.style.webkitWritingMode = "horizontal-tb";
       innerSpan.style.display = "list-item";
       mostInnerSpan.style.display = "list-item";
       document.getSelection().setBaseAndExtent(container, 0, document.body, document.body.childNodes.length);
       if (window.testRunner)
         testRunner.notifyDone();
     }, 0);
   }
 </script>
 </head>
 <body onload=runTest()>
 Pass if no crash or assert.
 <div id="container" style="-webkit-writing-mode: vertical-rl"><table><tr><td><li id="li"><span id="innerSpan"><span id="mostInnerSpan"></span></span></li></tr></td></table>
 </body>
 </html>
	<!DOCTYPE html>
	<html>
	<head>
	<title>This tests that we don't mutate the render tree during selection.</title>
	<style>
	body {
	column-count: 2;
	}
	</style>
	<script>
	if (window.testRunner) {
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	}

	function runTest() {
	setTimeout(function() {
	li.style.webkitWritingMode = "horizontal-tb";
	innerSpan.style.display = "list-item";
	mostInnerSpan.style.display = "list-item";
	document.getSelection().setBaseAndExtent(container, 0, document.body, document.body.childNodes.length);
	if (window.testRunner)
	testRunner.notifyDone();
	}, 0);
	}
	</script>
	</head>
	<body onload=runTest()>
	Pass if no crash or assert.
	<div id="container" style="-webkit-writing-mode: vertical-rl"><table><tr><td><li id="li"><span id="innerSpan"><span id="mostInnerSpan"></span></span></li></tr></td></table>
	</body>
	</html>