| <!DOCTYPE html> |
| <html> |
| <head> |
| <title>Issue 348283 crash test case</title> |
| <style> |
| table { |
| visibility: collapse; |
| } |
| |
| *:only-child { |
| visibility: visible; |
| } |
| </style> |
| </head> |
| <!-- This is a minified version of the clusterfuzz test case at https://code.google.com/p/chromium/issues/detail?id=348283 --> |
| <body contenteditable="true"> |
| <script> |
| window.onload = function () { |
| var table = document.getElementById('table'); |
| table.insertAdjacentHTML('afterbegin', '<svg></svg><div><div id=\'div\'>text</div>'); |
| |
| var div = document.getElementById('div'); |
| var selection = window.getSelection(); |
| selection.collapse(div.firstChild, 0); |
| document.execCommand('InsertImage', false, 'about:blank'); |
| window.parent.postMessage('FINISH', '*'); |
| }; |
| </script> |
| |
| <table id="table" ></table> |
| <div></div> |
| </body> |
| </html> |
