editor/libeditor/crashtests/1414581.html

   1 <!DOCTYPE html>
   2 <html>
   3 <head>
   4 <script>
   5 function jsfuzzer() {
   6   document.execCommand("outdent", false);
   7 }
   8 function eventhandler2() {
   9   document.execCommand("styleWithCSS", false, true);
  10 }
  11 function eventhandler3() {
  12   document.execCommand("delete", false);
  13   var element1 = document.getElementById("element1");
  14   document.getSelection().setPosition(element1, 0);
  15   var element1 = document.getElementById("element2");
  16   element2.ownerDocument.execCommand("insertOrderedList", false);
  17   var element1 = document.getElementById("element3");
  18   element3.addEventListener("DOMSubtreeModified", eventhandler3);
  19   document.activeElement.setAttribute("contenteditable", "true");
  20 }
  21 </script>
  22 </head>
  23 <body onload=jsfuzzer()>
  24 <i id="element1">
  25 <audio i src="x"></audio>
  26 <da id="element2">
  27 <br id="element3" style="">
  28 <svg onload="eventhandler3()">
  29 <animate onbegin="eventhandler2()">
  30 <body>
  31 </html>