<!DOCTYPE html>
<html>
<body>
This test verifies that deleting DOM elements in a DOMSubtreeModified handler triggered by and execCommand('bold') does not produce a crash.
<div id="test" contenteditable style="border: 1px solid red">
<b class="x" id="inlined">
<u></u>
x
</b>
</div>
<script>
function treeModifiedHandler()
{
document.removeEventListener("DOMSubtreeModified", treeModifiedHandler, false);
var b = document.getElementById("inlined");
b.insertBefore(document.createTextNode(""), b.firstChild);
var range = document.createRange();
range.setStart(b,0);
range.setEnd(b,2);
range.deleteContents();
document.body.appendChild(document.createTextNode("PASS"));
}
function runtest()
{
var test = document.getElementById('test');
window.getSelection().selectAllChildren(test);
document.execCommand('bold', false, null);
document.addEventListener("DOMSubtreeModified", treeModifiedHandler, false);
document.execCommand('bold', false, null);
}
if (window.testRunner)
testRunner.dumpAsText();
runtest();
</script>
</body>
</html>