third_party/WebKit/LayoutTests/editing/selection/replace-selection-crash.html

   1 <html>
   2     <head>
   3         <script>
   4             function test()
   5             {
   6                 if (window.testRunner)
   7                     testRunner.dumpAsText();
   8
   9                 document.getElementsByTagName("div")[0].focus();
  10
  11                 var sel = window.getSelection();
  12                 var paragraphs = document.getElementsByTagName("p");
  13                 sel.setBaseAndExtent(paragraphs[0].lastChild, 0, paragraphs[0].lastChild, 2);
  14                 document.execCommand("InsertHTML", false, '<p>No crash!</p>');
  15                 sel.setBaseAndExtent(paragraphs[1].lastChild, 2, paragraphs[1].lastChild, 4);
  16                 document.execCommand("InsertHTML", false, '<p>No crash!</p>');
  17                 sel.setBaseAndExtent(paragraphs[2].lastChild, 4, paragraphs[2].lastChild, 6);
  18                 document.execCommand("InsertHTML", false, '<p>No crash!</p>');
  19                 sel.setBaseAndExtent(paragraphs[3].lastChild, 0, paragraphs[3].lastChild, 6);
  20                 document.execCommand("InsertHTML", false, '<p>No crash!</p>');
  21             }
  22         </script>
  23     </head>
  24     <body onload="test()">
  25         <div contenteditable>
  26             <p><span style="white-space: pre">    </span>select&nbsp;</p>
  27             <p><span style="white-space: pre">    </span>select&nbsp;</p>
  28             <p><span style="white-space: pre">    </span>select&nbsp;</p>
  29             <p><span style="white-space: pre">    </span>select&nbsp;</p>
  30         </div>
  31     </body>
  32 </html>