line-break-removal-near-textarea-crash.html

<!DOCTYPE html>
<html>
<style>
.style1 { display: table-row; content: counter(section); }
.style2 { position: fixed; }
.style3 { vertical-align: super; -webkit-appearance: button; -webkit-column-width: 100px; }
.style3:nth-of-type(2n) { display: list-item; }
</style>
<script>
window.onload = function() {
    div1 = document.createElement('div');
    document.documentElement.appendChild(div1);

    spanElem1 = document.createElement('span');
    spanElem1.setAttribute('class', 'style3');
    document.documentElement.appendChild(spanElem1);
    
    spanElem2 = document.createElement('span');
    spanElem1.appendChild(spanElem2);
    spanElem1.appendChild(document.createTextNode('abc'));

    textareaElem = document.createElement('textarea');
    textareaElem.setAttribute('class', 'style1');
    spanElem2.appendChild(textareaElem);

    canvasElem = document.createElement('canvas');
    spanElem2.appendChild(canvasElem);

    paragraphElem = document.createElement('p');
    paragraphElem.setAttribute('class', 'style2');
    spanElem2.appendChild(paragraphElem);

    document.execCommand("SelectAll", false, "");
    window.scrollBy(-15, -48);
    document.documentElement.offsetHeight;

    div1.setAttribute('class', 'style3');
    spanElem2.removeChild(paragraphElem);

    if (window.testRunner)
        testRunner.dumpAsText();
}
</script>
<body>
PASS, if no crash or assert in debug
</body>
</html>
chromium/third_party/blink/web_tests/fast/block/line-layout/line-break-removal-near-textarea-crash.html
