third_party/WebKit/LayoutTests/editing/execCommand/insert-html-to-document-element-crash.html

   1 <!DOCTYPE html>
   2 <head>
   3 <script>
   4 if (window.testRunner)
   5     testRunner.dumpAsText();
   6
   7 onload = function() {
   8     // Make documentElement to P element without HTML and BODY.
   9     var htmlElement = document.documentElement;
  10     var target = document.getElementById('target');
  11     document.replaceChild(target, htmlElement);
  12
  13     document.designMode = 'on';
  14     window.getSelection().collapse(target, 0);
  15     document.execCommand('InsertHTML', false, '<pre></pre>');
  16
  17     // Here, document.documentElement is null.
  18     document.write('PASS if Blink doesn\'t crash.');
  19 };
  20 </script>
  21 </head>
  22 <body>
  23 <p id="target"></p>
  24 </body>
  25 </html>