third_party/WebKit/LayoutTests/svg/foreignObject/viewport-foreignobject-crash.html

   1 <html>
   2 <body>
   3 <script>
   4 var script = document.getElementsByTagName("script")[0];
   5 script.parentNode.removeChild(script);
   6
   7 var count = 0;
   8 function crash() {
   9     var element = event.srcElement;
  10     document.adoptNode(element);
  11     if (!document.body.innerHTML)
  12         return;
  13     document.execCommand('InsertHTML', false, document.body.innerHTML);
  14     if (count == 1) {
  15         document.removeEventListener("DOMNodeInserted", crash, false);
  16         document.body.innerHTML = "PASS";
  17         return;
  18     }
  19     count += 1;
  20     document.body.appendChild(element);
  21     element.insertAdjacentHTML('beforeend', '<svg><foreignObject>A</foreignObject></svg>');
  22     element.focus();
  23 }
  24
  25 document.addEventListener("DOMNodeInserted", crash, false);
  26 document.addEventListener("DOMContentLoaded", function () {
  27     document.execCommand("SelectAll", false, false);
  28     var range = window.getSelection().getRangeAt(0);
  29     var docFragment = range.extractContents();
  30     document.documentElement.firstChild.appendChild(docFragment);
  31 }, false);
  32 </script>
  33 <input/>
  34 </body>
  35 </html>