| <!DOCTYPE html> | |
| <html> | |
| <body> | |
| This test verifies that deleting DOM elements in a DOMSubtreeModified handler triggered by and execCommand('bold') does not produce a crash. | |
| <div id="test" contenteditable style="border: 1px solid red"> | |
| <b class="x" id="inlined"> | |
| <u></u> | |
| x | |
| </b> | |
| </div> | |
| <script> | |
| function treeModifiedHandler() | |
| { | |
| document.removeEventListener("DOMSubtreeModified", treeModifiedHandler, false); | |
| var b = document.getElementById("inlined"); | |
| b.insertBefore(document.createTextNode("test"), b.firstChild); | |
| var range = document.createRange(); | |
| range.setStart(b,0); | |
| range.setEnd(b,2); | |
| range.deleteContents(); | |
| document.body.appendChild(document.createTextNode("PASS")); | |
| } | |
| function runtest() | |
| { | |
| var test = document.getElementById('test'); | |
| window.getSelection().selectAllChildren(test); | |
| document.execCommand('bold', false, null); | |
| document.addEventListener("DOMSubtreeModified", treeModifiedHandler, false); | |
| document.execCommand('bold', false, null); | |
| } | |
| if (window.testRunner) | |
| testRunner.dumpAsText(); | |
| runtest(); | |
| </script> | |
| </body> | |
| </html> |