third_party/WebKit/LayoutTests/fast/text/text-fragment-first-letter-update-crash.html

   1 <!DOCTYPE html>
   2 <html>
   3 <body>
   4 <style>
   5 #el0 { -webkit-columns: 1; }
   6 #el2:first-of-type { }
   7 #el2:first-letter { content: counter(c); }
   8 #el3 { -webkit-column-span: all; content: counter(c) attr(A); }
   9 </style>
  10 <script>
  11 if (window.testRunner)
  12     testRunner.dumpAsText();
  13
  14 document.body.offsetTop;
  15 el0 = document.createElement('div');
  16 el0.setAttribute('id', 'el0');
  17 document.body.appendChild(el0);
  18 el1=document.createElement('b');
  19 el0.appendChild(el1);
  20 el1.appendChild(document.createTextNode('A'));
  21 el2=document.createElement('div');
  22 el2.setAttribute('id','el2');
  23 el0.appendChild(el2);
  24 el3=document.createElement('div');
  25 el3.setAttribute('id', 'el3');
  26 el2.appendChild(el3);
  27 document.designMode = 'on';
  28 document.execCommand('selectall');
  29 el2.appendChild(document.createTextNode('AA'));
  30 document.designMode = 'on';
  31 document.execCommand('selectall');
  32 document.execCommand('removeFormat');
  33 document.body.offsetTop;
  34 document.body.innerHTML = "PASS. WebKit didn't crash.";
  35
  36 </script>
  37 </body>
  38 </html>