third_party/WebKit/LayoutTests/editing/selection/move-node-in-selection-crash.html

   1 <style>
   2 p { position: fixed; height: 1px; }
   3 hgroup { position: fixed; padding-bottom: 1px; padding-left: 100%; -webkit-column-span: all; }
   4 sup { display: -webkit-box; }
   5 </style>
   6 <script>
   7 if (window.testRunner)
   8   testRunner.dumpAsText();
   9
  10 window.onload = function() {
  11   document.documentElement.appendChild(document.createElement('span'));
  12   var grandparent = document.createElement('p');
  13   document.documentElement.appendChild(grandparent);
  14   document.execCommand('SelectAll', '');
  15
  16   grandparent.appendChild(document.createElement('hgroup'));
  17   var oldParent = document.createElement('span');
  18   grandparent.appendChild(oldParent);
  19   var childToMove = document.createElement('sup');
  20   oldParent.appendChild(childToMove);
  21
  22   document.body.offsetHeight;
  23
  24   // Move childToMove under the orphaned parent.
  25   var orphanedParent = document.createElement('div');
  26   orphanedParent.appendChild(childToMove);
  27 };
  28 </script>
  29 This is modified from a cluster-fuzz test case. Passes if no crash.