Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/editing/execCommand/apply-inline-style-to-element-with-no-renderer-crash.html 

<!DOCTYPE html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<svg>
    <text>
        <tspan id="tspan">
            <tspan id="tspan2">%uef5f%u9776%u638a</tspan>
            <textPath id="textPath"></textPath>
        </tspan>
    </text>
</svg>
<div id="log"></div>
<script>
// crbug.com/339185: If we create an anchor element using execCommand('CreateLink') in an SVG namespace it won't get a renderer because the command will create
// an HTML rather than an SVG anchor. Our subsequent attempt to apply an inline style on the should fail rather than result in a crash.
test(function() {
    tspan = document.getElementById("tspan");
    tspan2 = document.getElementById("tspan2");
    textPath = document.getElementById("textPath");

    colorprofile = document.createElementNS('http://www.w3.org/2000/svg', 'color_profile');
    li = document.createElement('li');
    colorprofile.appendChild(li);
    document.implementation.createDocument('' ,'' ,null).adoptNode(colorprofile)

    input=document.createElement('input');
    textPath.parentNode.insertBefore(input, textPath);
    window.getSelection().setBaseAndExtent(input, 0, null, 0);

    document.designMode='on';
    document.execCommand('Transpose');
    document.execCommand('selectall');
    document.execCommand('CreateLink', 0, '#');
    document.execCommand('CreateLink', 0, '#');
    document.execCommand('Undo');
    document.designMode='off'
    document.execCommand('Undo');
    document.execCommand('Undo');
    document.designMode='on';
    document.execCommand('italic');
});
</script>