| <!DOCTYPE html> |
| <html> |
| <head> |
| <script> |
| // This test uses a weired textarea to reproduce the issue. The condition of a crash is very sensitive to HTML. |
| // If we add a new-line at EOF or add other tags in <body> part, the crash will be unlikely to happen. |
| // For example, if we move this comment to the actual HTML or try to load 'js-test-pre.js', the crash won't happen. |
| // |
| // * Mutation events should not be dispatched on this case. This bug is being tracked by webkit bug https://bugs.webkit.org/show_bug.cgi?id=87372 |
| // * ... And Mutation events are no longer fired. See https://bugs.webkit.org/show_bug.cgi?id=93427. |
| // We would keep this test just for preventing regression. |
| if (window.testRunner) { |
| testRunner.dumpAsText(); |
| testRunner.waitUntilDone(); |
| } |
| |
| function attackAndFinish() { |
| document.designMode = "on"; |
| document.execCommand("SelectAll"); |
| document.execCommand("Delete"); |
| document.body.offsetLeft; |
| document.body.innerHTML = 'Test passes if a DOMCharacterModified event on the textarea does not crash.'; |
| if (window.testRunner) |
| testRunner.notifyDone(); |
| } |
| |
| document.addEventListener("DOMCharacterDataModified", attackAndFinish); |
| |
| window.setTimeout(attackAndFinish, 10); |
| </script> |
| </head> |
| <textarea> < |
