1 files changed, 72 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/448329-1.html b/editor/libeditor/crashtests/448329-1.html
new file mode 100644
index 000000000..99d0f63b3
--- /dev/null
+++ b/editor/libeditor/crashtests/448329-1.html
@@ -0,0 +1,72 @@
+<!DOCTYPE HTML>
+<html><head>
+    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+    <title>Testcase for bug 448329</title>
+</head>
+<body>
+
+<iframe id="frame448329"></iframe>
+
+<script>
+
+function test448329(id,cmd) {
+
+  var elm = document.getElementById(id);
+  var doc = elm.contentDocument;
+  doc.designMode = "On";
+
+  // Work around getSelection depending on a presshell but not flushing to get
+  // one.
+  doc.body.offsetWidth;
+  var s = doc.defaultView.getSelection();
+
+  // Test document node
+  if (s.rangeCount > 0)
+    s.removeAllRanges();
+  var range = doc.createRange();
+  range.setStart(doc, 0);
+  range.setEnd(doc, 0);
+  s.addRange(range);
+  doc.queryCommandIndeterm(cmd);
+
+  // Test HTML node
+  if (s.rangeCount > 0)
+    s.removeAllRanges();
+  range = doc.createRange();
+  range.setStart(doc.documentElement, 0);
+  range.setEnd(doc.documentElement, 0);
+  s.addRange(range);
+  doc.queryCommandIndeterm(cmd);
+
+  // Test BODY node
+  if (s.rangeCount > 0)
+    s.removeAllRanges();
+  range = doc.createRange();
+  var body = doc.documentElement.childNodes[1];
+  range.setStart(body, 0);
+  range.setEnd(body, 0);
+  s.addRange(range);
+  doc.queryCommandIndeterm(cmd);
+
+  var text = doc.createTextNode("Hello Kitty");
+  body.insertBefore(text, null)
+
+  // Test TEXT node
+  if (s.rangeCount > 0)
+    s.removeAllRanges();
+  range = doc.createRange();
+  range.setStart(text, 0);
+  range.setEnd(text, 1);
+  s.addRange(range);
+  doc.queryCommandIndeterm(cmd);
+
+}
+
+test448329("frame448329", "backcolor")
+test448329("frame448329", "hilitecolor")
+
+</script>
+
+
+</body>
+</html>