<!DOCTYPE html>
<html>
<head>
<script>
// This test uses a weired textarea to reproduce the issue. The condition of a crash is very sensitive to HTML.
// If we add a new-line at EOF or add other tags in <body> part, the crash will be unlikely to happen.
// For example, if we move this comment to the actual HTML or try to load 'js-test-pre.js', the crash won't happen.
//
// * Mutation events should not be dispatched on this case. This bug is being tracked by webkit bug https://bugs.webkit.org/show_bug.cgi?id=87372
// * ... And Mutation events are no longer fired. See https://bugs.webkit.org/show_bug.cgi?id=93427.
//   We would keep this test just for preventing regression.
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

function attackAndFinish() {
    document.designMode = "on";
    document.execCommand("SelectAll");
    document.execCommand("Delete");
    document.body.offsetLeft;
    document.body.innerHTML = 'Test passes if a DOMCharacterModified event on the textarea does not crash.';
    if (window.testRunner)
        testRunner.notifyDone();
}

document.addEventListener("DOMCharacterDataModified", attackAndFinish);

window.setTimeout(attackAndFinish, 10);
</script>
</head>
<textarea> <