crash-inserting-list.html | Explore in Territory

<!doctype html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script src="../assert_selection.js"></script>
<script>
// It is a minimized testcase for a Clusterfuzz test. See crbug.com/345373
test(() => assert_selection(
    [
      '<style>',
      '* { float:left; }',
      '.class0 { content: url(); }',
      '</style>',
      '<ul class="class0">',
        '<li id="r0"></li>',
        '<li id="r1"></li>',
      '</ul>',
      '<hr>',
    ].join(''),
    selection => {
        let domNodeRemovedFireCount = 0;
        selection.document.addEventListener('DOMNodeRemoved', (event) => {
          if (domNodeRemovedFireCount >= 1)
            return;
          ++domNodeRemovedFireCount;
          const element = event.srcElement;
          selection.document.execCommand('InsertOrderedList');

          const parentElement = selection.document.getElementById('r1');
          const childElement = parentElement.childNodes[0];
          parentElement.insertBefore(element, childElement);

          selection.document.execCommand('Undo');
          selection.document.execCommand('Redo');
          selection.document.execCommand('Outdent');
        });

        selection.document.designMode = 'on';
        selection.document.execCommand('SelectAll');
        const range = selection.getRangeAt(0);
        const insertedElement = selection.document.getElementById('r0');
        range.insertNode(insertedElement);
    },
    [
      '<style>',
      '* { float:left; }',
      '.class0 { content: url(); }',
      '</style>',
      '<ul>',
        '<li id="r1"></li>',
      '</ul>',
      '<ol><li><br></li></ol>',
      '^<hr>|',
    ].join('')));
</script>
chromium/third_party/blink/web_tests/editing/execCommand/crash-inserting-list.html
