third_party/WebKit/LayoutTests/editing/apply-inline-style-to-element-with-no-renderer-crash.html

   1 <script>
   2 // crbug.com/339185: If we create an anchor element using execCommand('CreateLink') in an SVG namespace it won't get a renderer because the command will create
   3 // an HTML rather than an SVG anchor. Our subsequent attempt to apply an inline style on the should fail rather than result in a crash.
   4 onload = function() {
   5     tspan = document.getElementById("tspan");
   6     tspan2 = document.getElementById("tspan2");
   7     textPath = document.getElementById("textPath");
   8
   9     colorprofile = document.createElementNS('http://www.w3.org/2000/svg', 'color_profile');
  10     li = document.createElement('li');
  11     colorprofile.appendChild(li);
  12     document.implementation.createDocument('' ,'' ,null).adoptNode(colorprofile)
  13
  14     input=document.createElement('input');
  15     textPath.parentNode.insertBefore(input, textPath);
  16     window.getSelection().setBaseAndExtent(input, 4);
  17
  18     document.designMode='on';
  19     document.execCommand('Transpose');
  20     document.execCommand('selectall');
  21     document.execCommand('CreateLink', 0, '#');
  22     document.execCommand('CreateLink', 0, '#');
  23     document.execCommand('Undo');
  24     document.designMode='off'
  25     document.execCommand('Undo');
  26     document.execCommand('Undo');
  27     document.designMode='on';
  28     document.execCommand('italic');
  29 }
  30 </script>
  31 <svg>
  32     <text>
  33         <tspan id="tspan">
  34             <tspan id="tspan2">%uef5f%u9776%u638a</tspan>
  35             <textPath id="textPath"></textPath>
  36         </tspan>
  37     </text>
  38 </svg>