third_party/WebKit/LayoutTests/editing/selection/selection-modify-crash.html

   1 <html>
   2 <head>
   3 <script>
   4 if (window.testRunner) {
   5     testRunner.dumpAsText();
   6     testRunner.waitUntilDone();
   7 }
   8
   9 function test()
  10 {
  11     var htmlElement = document.firstChild;
  12     // Create a range.
  13     var staleRange = document.createRange();
  14
  15     // Delete document.body:
  16     var range = document.createRange();
  17     range.setEndAfter(htmlElement);
  18     range.deleteContents();
  19
  20     var selection = window.getSelection();
  21     selection.addRange(staleRange);
  22     selection.modify("extend", "forward", "documentboundary"); // WebKit crashed here.
  23
  24     // Recreate the HTML element to show 'PASS'.
  25     document.appendChild(document.createElement('html'));
  26     document.firstChild.innerHTML = '<body>PASS</body>';
  27     if (window.testRunner)
  28         testRunner.notifyDone();
  29 }
  30 </script>
  31 </head>
  32 <body onload="test()">
  33 </body>
  34 </html>