| OLD | NEW |
|---|
| (Empty) | |
| 1 <!DOCTYPE HTML> |
| 2 <html> |
| 3 <head> |
| 4 <style> |
| 5 * { display:run-in; } |
| 6 .collapse { visibility:collapse; } |
| 7 </style> |
| 8 <script> |
| 9 |
| 10 if (window.testRunner) { |
| 11 window.testRunner.dumpAsText(); |
| 12 window.testRunner.waitUntilDone(); |
| 13 } |
| 14 |
| 15 document.designMode = "on"; |
| 16 var scriptElements = document.getElementsByTagName("script"); |
| 17 scriptElements[0].parentNode.removeChild(scriptElements[0]); |
| 18 var eventHandlerActive = false; |
| 19 |
| 20 function event_handler_webkitEditableContentChanged() { |
| 21 if (eventHandlerActive) |
| 22 return; |
| 23 eventHandlerActive = true; |
| 24 var srcElement = event.srcElement; |
| 25 document.execCommand('InsertText',false,'dummy text'); |
| 26 srcElement.textContent = "Pass. Test didn't crash."; |
| 27 eventHandlerActive = false; |
| 28 if (window.testRunner) |
| 29 window.testRunner.notifyDone(); |
| 30 } |
| 31 |
| 32 document.addEventListener("webkitEditableContentChanged", event_handler_webkitEd
itableContentChanged, true); |
| 33 |
| 34 function event_handler_DOMCharacterDataModified() { |
| 35 document.execCommand('InsertParagraph',false,false); |
| 36 } |
| 37 |
| 38 document.addEventListener("DOMCharacterDataModified", event_handler_DOMCharacter
DataModified, false); |
| 39 |
| 40 setTimeout(function() { |
| 41 var selection=window.getSelection(); |
| 42 document.execCommand("SelectAll", false) |
| 43 var range = selection.getRangeAt(0); |
| 44 var documentFragment = range.extractContents(); |
| 45 document.execCommand('Undo',false); |
| 46 }, 1); |
| 47 </script> |
| 48 </head> |
| 49 <body> |
| 50 <table class="collapse"> |
| 51 <caption> |
| 52 original text |
| 53 </caption> |
| 54 </table> |
| 55 </body> |
| 56 </html> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 14829006:
Use after free in WebCore::dispatchEditableContentChangedEvents (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master