summaryrefslogtreecommitdiffstats
path: root/editor/libeditor/crashtests/766845.xhtml
blob: 409e210109b894afd9d3f1aadf459d2e2be59b00 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script>
<![CDATA[

function boom()
{
  window.getSelection().removeAllRanges();
  var r1 = document.createRange();
  r1.setStart(document.body, 0);
  r1.setEnd  (document.body, 1);
  window.getSelection().addRange(r1);
  var r2 = document.createRange();
  r2.setStart(document.body, 1);
  r2.setEnd  (document.body, 2);
  window.getSelection().addRange(r2);
  if (document.queryCommandEnabled("inserthtml"))
    document.execCommand("inserthtml", false, "1");
}

]]>
</script>
</head>

<body contenteditable="true" onload="boom();"><div></div><div></div></body>

</html>