| <!DOCTYPE html> |
| <html> |
| <body> |
| This test verifies that deleting DOM elements in a DOMSubtreeModified handler triggered by and execCommand('bold') does not produce a crash. |
| <div id="test" contenteditable style="border: 1px solid red"> |
| <b class="x" id="inlined"> |
| <u></u> |
| x |
| </b> |
| </div> |
| <script> |
| function treeModifiedHandler() |
| { |
| document.removeEventListener("DOMSubtreeModified", treeModifiedHandler, false); |
| |
| var b = document.getElementById("inlined"); |
| b.insertBefore(document.createTextNode(""), b.firstChild); |
| |
| var range = document.createRange(); |
| range.setStart(b,0); |
| range.setEnd(b,2); |
| range.deleteContents(); |
| document.body.appendChild(document.createTextNode("PASS")); |
| } |
| |
| function runtest() |
| { |
| var test = document.getElementById('test'); |
| window.getSelection().selectAllChildren(test); |
| |
| document.execCommand('bold', false, null); |
| document.addEventListener("DOMSubtreeModified", treeModifiedHandler, false); |
| document.execCommand('bold', false, null); |
| } |
| |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| |
| runtest(); |
| </script> |
| </body> |
| </html> |
