The Tor Browser / file comparison
comparison: editor/libeditor/base/crashtests/766413.html
editor/libeditor/base/crashtests/766413.html
- branch
- TOR_BUG_3246
- changeset 7
- 129ffea94266
equal
deleted
inserted
replaced
| -1:000000000000 | 0:eb8faeec825f |
|---|---|
| 1 <!DOCTYPE html> | |
| 2 <html> | |
| 3 <head> | |
| 4 <script> | |
| 5 | |
| 6 function boom() | |
| 7 { | |
| 8 var root = document.documentElement; | |
| 9 while (root.firstChild) { | |
| 10 root.removeChild(root.firstChild); | |
| 11 } | |
| 12 | |
| 13 var space = document.createTextNode(" "); | |
| 14 var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body"); | |
| 15 root.contentEditable = "true"; | |
| 16 root.focus(); | |
| 17 document.execCommand("contentReadOnly", false, null); | |
| 18 root.appendChild(body); | |
| 19 root.contentEditable = "false"; | |
| 20 root.appendChild(space); | |
| 21 root.removeChild(body); | |
| 22 root.contentEditable = "true"; | |
| 23 | |
| 24 window.getSelection().removeAllRanges(); | |
| 25 var r1 = document.createRange(); | |
| 26 r1.setStart(root, 0); | |
| 27 r1.setEnd(root, 0); | |
| 28 window.getSelection().addRange(r1); | |
| 29 looseText = document.createTextNode("c"); | |
| 30 var r2 = document.createRange(); | |
| 31 r2.setStart(looseText, 0); | |
| 32 r2.setEnd(looseText, 0); | |
| 33 window.getSelection().addRange(r2); | |
| 34 | |
| 35 document.execCommand("forwardDelete", false, null); | |
| 36 } | |
| 37 | |
| 38 </script> | |
| 39 </head> | |
| 40 | |
| 41 <body onload="boom();"></body> | |
| 42 </html> |
