<!DOCTYPE html>
<html>
<head>
<script>
// This test uses a weired textarea to reproduce the issue. The condition of a crash is very sensitive to HTML.
// If we add a new-line at EOF or add other tags in <body> part, the crash will be unlikely to happen.
// For example, if we move this comment to the actual HTML or try to load 'js-test.js', the crash won't happen.
//
// * Mutation events should not be dispatched on this case. This bug is being tracked by webkit bug https://bugs.webkit.org/show_bug.cgi?id=87372
// * ... And Mutation events are no longer fired. See https://bugs.webkit.org/show_bug.cgi?id=93427.
// We would keep this test just for preventing regression.
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.waitUntilDone();
}
function attackAndFinish() {
document.designMode = "on";
document.execCommand("SelectAll");
document.execCommand("Delete");
document.body.offsetLeft;
document.body.innerHTML = 'Test passes if a DOMCharacterModified event on the textarea does not crash.';
if (window.testRunner)
testRunner.notifyDone();
}
document.addEventListener("DOMCharacterDataModified", attackAndFinish);
window.setTimeout(attackAndFinish, 10);
</script>
</head>
<textarea> <