editor/libeditor/html/crashtests/761861.html
author Aryeh Gregor <ayg@aryeh.name>
Wed, 06 Jun 2012 14:19:16 +0300
changeset 95959 c4da1c7555eebab7e250de0ad61b2291b8442732
permissions -rw-r--r--
Bug 761861 - Fix crash in nsHTMLEditor::DeleteSelectionImpl; r=ehsan

<!doctype html>
<script>
function boom() {
  var r = document.documentElement;
  while (r.firstChild) {
    r.removeChild(r.firstChild);
  }

  document.documentElement.contentEditable = "true";
  document.documentElement.appendChild(document.createElement("span"));
  document.documentElement.firstChild.appendChild(document.createTextNode("_"));
  document.execCommand("forwarddelete");
}
</script>
<body onload="boom()">