LayoutTests/editing/style/bold-with-dom-changes.html - WebKit - Git at Google

 <!DOCTYPE html>
 <html>
 <body>
 This test verifies that deleting DOM elements in a DOMSubtreeModified handler triggered by and execCommand('bold') does not produce a crash.
 <div id="test" contenteditable style="border: 1px solid red">
 <b class="x" id="inlined">
     <u></u>
     x
 </b>
 </div>
 <script>
 function treeModifiedHandler()
 {
     document.removeEventListener("DOMSubtreeModified", treeModifiedHandler, false);

     var b = document.getElementById("inlined");
     b.insertBefore(document.createTextNode("test"), b.firstChild);

     var range = document.createRange();
     range.setStart(b,0);
     range.setEnd(b,2);
     range.deleteContents();
     document.body.appendChild(document.createTextNode("PASS"));
 }

 function runtest()
 {
     var test = document.getElementById('test');
     window.getSelection().selectAllChildren(test);

     document.execCommand('bold', false, null);
     document.addEventListener("DOMSubtreeModified", treeModifiedHandler, false);
     document.execCommand('bold', false, null);
 }

 if (window.testRunner)
     testRunner.dumpAsText();

 runtest();
 </script>
 </body>
 </html>
	<!DOCTYPE html>
	<html>
	<body>
	This test verifies that deleting DOM elements in a DOMSubtreeModified handler triggered by and execCommand('bold') does not produce a crash.
	<div id="test" contenteditable style="border: 1px solid red">
	<b class="x" id="inlined">
	<u></u>
	x
	</b>
	</div>
	<script>
	function treeModifiedHandler()
	{
	document.removeEventListener("DOMSubtreeModified", treeModifiedHandler, false);

	var b = document.getElementById("inlined");
	b.insertBefore(document.createTextNode("test"), b.firstChild);

	var range = document.createRange();
	range.setStart(b,0);
	range.setEnd(b,2);
	range.deleteContents();
	document.body.appendChild(document.createTextNode("PASS"));
	}

	function runtest()
	{
	var test = document.getElementById('test');
	window.getSelection().selectAllChildren(test);

	document.execCommand('bold', false, null);
	document.addEventListener("DOMSubtreeModified", treeModifiedHandler, false);
	document.execCommand('bold', false, null);
	}

	if (window.testRunner)
	testRunner.dumpAsText();

	runtest();
	</script>
	</body>
	</html>