third_party/WebKit/LayoutTests/editing/selection/table-element-crash.html

   1 <!DOCTYPE html>
   2 <html id='html'>
   3 <head>
   4 <!-- It is a minimized testcase of fuzz test. See crbug.com/343037 -->
   5 <script>
   6 if (window.testRunner)
   7   testRunner.dumpAsText();
   8
   9 window.onload = function() {
  10   var selection = window.getSelection();
  11   document.execCommand('SelectAll');
  12   selection.collapseToEnd();
  13
  14   // Shuffling and htmlElement.innerHTML = '' cause that nested table element does not have renderer in the selection.
  15   var range = selection.getRangeAt(0);
  16   range.insertNode(document.getElementById('nested_table'));
  17   range.surroundContents(document.getElementById('caption'));
  18   document.getElementById('table').insertAdjacentHTML('beforebegin', '<div id="target"></div>');
  19   range.surroundContents(document.getElementById('target'));
  20   selection.extend(document.getElementById('target'), 0);
  21
  22   var htmlElement = document.getElementById('html');
  23   htmlElement.innerHTML = '';
  24   htmlElement.parentNode.replaceChild(document.createElement('div'), htmlElement);
  25   document.getElementsByTagName('div')[0].innerText = 'This test passes if it does not crash.';
  26 };
  27 </script>
  28 </head>
  29 <body>
  30 <table id='table'>
  31   <caption id='caption'>
  32     <table id='nested_table'></table>
  33   </caption>
  34 </table>
  35 </body>
  36 </html>