The Tor Browser / file comparison
comparison: editor/libeditor/html/crashtests/767169.html
editor/libeditor/html/crashtests/767169.html
- changeset 0
- 6474c204b198
equal
deleted
inserted
replaced
| -1:000000000000 | 0:13bc80b4976d |
|---|---|
| 1 <html> | |
| 2 <head> | |
| 3 <script> | |
| 4 | |
| 5 // Document must not have a doctype to trigger the bug | |
| 6 | |
| 7 function boom() | |
| 8 { | |
| 9 var root = document.documentElement; | |
| 10 while (root.firstChild) { root.removeChild(root.firstChild); } | |
| 11 root.contentEditable = "true"; | |
| 12 document.removeChild(root); | |
| 13 document.appendChild(root); | |
| 14 window.getSelection().collapse(root, 0); | |
| 15 window.getSelection().extend(document, 1); | |
| 16 document.removeChild(root); | |
| 17 } | |
| 18 | |
| 19 </script> | |
| 20 </head> | |
| 21 | |
| 22 <body onload="boom();"></body> | |
| 23 </html> |
