1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/editor/libeditor/html/crashtests/767169.html Wed Dec 31 06:09:35 2014 +0100
1.3 @@ -0,0 +1,23 @@
1.4 +<html>
1.5 +<head>
1.6 +<script>
1.7 +
1.8 +// Document must not have a doctype to trigger the bug
1.9 +
1.10 +function boom()
1.11 +{
1.12 + var root = document.documentElement;
1.13 + while (root.firstChild) { root.removeChild(root.firstChild); }
1.14 + root.contentEditable = "true";
1.15 + document.removeChild(root);
1.16 + document.appendChild(root);
1.17 + window.getSelection().collapse(root, 0);
1.18 + window.getSelection().extend(document, 1);
1.19 + document.removeChild(root);
1.20 +}
1.21 +
1.22 +</script>
1.23 +</head>
1.24 +
1.25 +<body onload="boom();"></body>
1.26 +</html>
