blob: 1f14d77ebebe42344ded0a2ac537fa1c7b508fef [file] [log] [blame]
<script>
if (window.testRunner)
testRunner.dumpAsText();
// If we create an anchor element using execCommand('CreateLink') in an SVG namespace it won't get a renderer because the command will create
// an HTML rather than an SVG anchor. Our subsequent attempt to apply an inline style on the should fail rather than result in a crash.
onload = function() {
tspan = document.getElementById("tspan");
tspan2 = document.getElementById("tspan2");
textPath = document.getElementById("textPath");
colorprofile = document.createElementNS('http://www.w3.org/2000/svg', 'color_profile');
li = document.createElement('li');
colorprofile.appendChild(li);
document.implementation.createDocument('' ,'' ,null).adoptNode(colorprofile)
input=document.createElement('input');
textPath.parentNode.insertBefore(input, textPath);
window.getSelection().setBaseAndExtent(input, 0, input, 0);
document.designMode='on';
document.execCommand('Transpose');
document.execCommand('selectall');
document.execCommand('CreateLink', 0, '#');
document.execCommand('CreateLink', 0, '#');
document.execCommand('Undo');
document.designMode='off'
document.execCommand('Undo');
document.execCommand('Undo');
document.designMode='on';
document.execCommand('italic');
document.write("PASS. WebKit didn't crash.");
}
</script>
<svg>
<text>
<tspan id="tspan">
<tspan id="tspan2">%uef5f%u9776%u638a</tspan>
<textPath id="textPath"></textPath>
</tspan>
</text>
</svg>