<!DOCTYPE html>
<html>
<body>
<p>This tests a crashing scenario where an element with a textbox role attribute which also contenteditable has its content changed.</p>
<div id="textbox" role="textbox" aria-multiline="true" contenteditable="true" tabindex="0">
Textbox content.
</div>

<script>

if (window.accessibilityController) {
    testRunner.dumpAsText();
    var textbox = document.getElementById("textbox");
    textbox.focus();
    var textboxAXElement = accessibilityController.focusedElement;

    getSelection().setBaseAndExtent(textbox.firstChild, 0, textbox.firstChild, 0);

    // This should not crash.
    document.execCommand("InsertParagraph");

    document.write("PASS");
}

</script>
</body>
</html>