editor/libeditor/crashtests/1424450.html

   1 <script>
   2 function onLoad() {
   3   const feComponentTransfer = document.querySelector("feComponentTransfer");
   4   // For emulating the traditional behavior, collapse Selection to end of the
   5   // text node in the <feComponentTransfer> which is the deepest last child of
   6   // the <body>.
   7   getSelection().collapse(
   8     feComponentTransfer.firstChild,
   9     feComponentTransfer.firstChild.length
  10   );
  11   getSelection().setPosition(
  12     document.querySelector("pre[contenteditable]"),
  13     1
  14   );
  15   getSelection().setBaseAndExtent(
  16     document.querySelector("fieldset"),
  17     0,
  18     document.querySelector("use"),
  19     0
  20   );
  21   feComponentTransfer.before(
  22     document.querySelector("font-face-uri").previousElementSibling
  23   );
  24
  25   document.execCommand("removeFormat");
  26   document.execCommand("hiliteColor", false, "-moz-buttondefault");
  27   document.execCommand("insertText", false, "");
  28 }
  29 function onBegin() {
  30   document.querySelector("desc").appendChild(
  31     document.querySelector("fieldset")
  32   );
  33   document.querySelector("span").appendChild(
  34     document.querySelector("a[hidden][contenteditable]")
  35   );
  36 }
  37 </script>
  38 <body onload="onLoad()">
  39 <span>
  40 <pre contenteditable>
  41 <fieldset></fieldset>
  42 <iframe srcdoc="H"></iframe>
  43 <a hidden contenteditable>
  44 <svg>
  45 <set onbegin="onBegin()"/>
  46 <use>
  47 <desc></desc>
  48 </use>
  49 <font-face-uri/>
  50 <feComponentTransfer>
  51 </feComponentTransfer></svg></a></pre></body>