delete-selection-with-null-range.html (960B)
1 <!DOCTYPE html> 2 <title> 3 This test crashes on Null-dereference READ in 4 blink::Range::StartPosition 5 </title> 6 <style> 7 .fieldset { 8 box-decoration-break: slice; 9 visibility: hidden !important; 10 } 11 *:last-child { 12 -webkit-border-vertical-spacing: 04.408cm; 13 -webkit-text-security: disc; 14 } 15 *:empty { 16 background-origin: inherit; 17 display: initial; 18 } 19 </style> 20 <script> 21 function run_on_page_load() { 22 document.designMode = "on"; 23 const oSelection = window.getSelection(); 24 document.execCommand("SelectAll"); 25 const oDocumentFragment = oSelection.getRangeAt(0).extractContents(); 26 } 27 document.addEventListener("DOMContentLoaded", run_on_page_load); 28 function run_on_readystatechange() { 29 document.execCommand("Indent"); 30 } 31 document.addEventListener( 32 "readystatechange", 33 run_on_readystatechange 34 ); 35 </script> 36 <h2>This test should not crash.</h2> 37 <fieldset class="fieldset" xml:space="preserve"></fieldset>