summaryrefslogtreecommitdiffstats
path: root/editor/libeditor/crashtests/772282.html
blob: f6259b344cf7d46ca4334e811ed536881f5a3522 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
<!DOCTYPE html>
<html>
<head>
<script>

function boom()
{
  var root = document.documentElement;
  while(root.firstChild) { root.removeChild(root.firstChild); }
  var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
  body.setAttributeNS(null, "contenteditable", "true");
  var img = document.createElementNS("http://www.w3.org/1999/xhtml", "img");
  body.appendChild(img);
  root.appendChild(body);
  document.removeChild(root);
  document.appendChild(root);
  document.execCommand("insertText", false, "5");
  document.execCommand("selectAll", false, null);
  document.execCommand("insertParagraph", false, null);
  document.execCommand("increasefontsize", false, null);
}

</script>
</head>

<body onload="boom();"></body>
</html>