OLD | NEW |
1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
2 <html> | 2 <html> |
3 <head> | 3 <head> |
4 <script> | 4 <script> |
5 // This test uses a weired textarea to reproduce the issue. The condition of a c
rash is very sensitive to HTML. | 5 // This test uses a weired textarea to reproduce the issue. The condition of a c
rash is very sensitive to HTML. |
6 // If we add a new-line at EOF or add other tags in <body> part, the crash will
be unlikely to happen. | 6 // If we add a new-line at EOF or add other tags in <body> part, the crash will
be unlikely to happen. |
7 // For example, if we move this comment to the actual HTML or try to load 'js-te
st-pre.js', the crash won't happen. | 7 // For example, if we move this comment to the actual HTML or try to load 'js-te
st-pre.js', the crash won't happen. |
8 // Mutation events should not be dispatched on this case. This bug is being trac
ked by webkit bug https://bugs.webkit.org/show_bug.cgi?id=87372 | 8 // |
9 if (window.testRunner) | 9 // * Mutation events should not be dispatched on this case. This bug is being tr
acked by webkit bug https://bugs.webkit.org/show_bug.cgi?id=87372 |
| 10 // * ... And Mutation events are no longer fired. See https://bugs.webkit.org/sh
ow_bug.cgi?id=93427. |
| 11 // We would keep this test just for preventing regression. |
| 12 if (window.testRunner) { |
10 testRunner.dumpAsText(); | 13 testRunner.dumpAsText(); |
| 14 testRunner.waitUntilDone(); |
| 15 } |
11 | 16 |
12 document.addEventListener("DOMCharacterDataModified", function() { | 17 function attackAndFinish() { |
13 document.designMode = "on"; | 18 document.designMode = "on"; |
14 document.execCommand("SelectAll"); | 19 document.execCommand("SelectAll"); |
15 document.execCommand("Delete"); | 20 document.execCommand("Delete"); |
16 document.body.offsetLeft; | 21 document.body.offsetLeft; |
17 document.body.innerHTML = 'Test passes if a DOMCharacterModified event on th
e textarea does not crash.'; | 22 document.body.innerHTML = 'Test passes if a DOMCharacterModified event on th
e textarea does not crash.'; |
18 }); | 23 if (window.testRunner) |
| 24 testRunner.notifyDone(); |
| 25 } |
| 26 |
| 27 document.addEventListener("DOMCharacterDataModified", attackAndFinish); |
| 28 |
| 29 window.setTimeout(attackAndFinish, 10); |
19 </script> | 30 </script> |
20 </head> | 31 </head> |
21 <textarea> < | 32 <textarea> < |
OLD | NEW |