third_party/WebKit/LayoutTests/fast/events/dom-character-data-modified-textarea-crash.html

   1 <!DOCTYPE html>
   2 <html>
   3 <head>
   4 <script>
   5 // This test uses a weired textarea to reproduce the issue. The condition of a crash is very sensitive to HTML.
   6 // If we add a new-line at EOF or add other tags in <body> part, the crash will be unlikely to happen.
   7 // For example, if we move this comment to the actual HTML or try to load 'js-test.js', the crash won't happen.
   8 //
   9 // * Mutation events should not be dispatched on this case. This bug is being tracked by webkit bug https://bugs.webkit.org/show_bug.cgi?id=87372
  10 // * ... And Mutation events are no longer fired. See https://bugs.webkit.org/show_bug.cgi?id=93427.
  11 //   We would keep this test just for preventing regression.
  12 if (window.testRunner) {
  13     testRunner.dumpAsText();
  14     testRunner.waitUntilDone();
  15 }
  16
  17 function attackAndFinish() {
  18     document.designMode = "on";
  19     document.execCommand("SelectAll");
  20     document.execCommand("Delete");
  21     document.body.offsetLeft;
  22     document.body.innerHTML = 'Test passes if a DOMCharacterModified event on the textarea does not crash.';
  23     if (window.testRunner)
  24         testRunner.notifyDone();
  25 }
  26
  27 document.addEventListener("DOMCharacterDataModified", attackAndFinish);
  28
  29 window.setTimeout(attackAndFinish, 10);
  30 </script>
  31 </head>
  32 <textarea> <