editor/libeditor/crashtests/1383755.html

   1 <html>
   2   <head>
   3     <script type="application/javascript">
   4       let table = document.createElement('table');
   5       document.documentElement.appendChild(table);
   6       let tr = document.createElement('tr');
   7       table.appendChild(tr);
   8       let input = document.createElement('input');
   9       document.documentElement.appendChild(input);
  10
  11       let img = document.createElement('img');
  12       input.appendChild(img);
  13       img.contentEditable = 'true'
  14       tr.appendChild(img);
  15       img.offsetParent;
  16
  17       // Since table's cell is selected by the following, it will show
  18       // object resizer that is anonymous element.
  19       window.getSelection().selectAllChildren(tr);
  20       // Document.adoptNode will remove anonymous element of object resizer
  21       // and it shouldn't cause crash
  22       document.implementation.createDocument('', '').adoptNode(table);
  23     </script>
  24   </head>
  25 </html>
  26