Bug 1383755 - Part 2. Add crash test for object resizer. r?masayuki
MozReview-Commit-ID: WLyLl5vIj0
new file mode 100644
--- /dev/null
+++ b/editor/libeditor/crashtests/1383755.html
@@ -0,0 +1,26 @@
+<html>
+ <head>
+ <script type="application/javascript">
+ let table = document.createElement('table');
+ document.documentElement.appendChild(table);
+ let tr = document.createElement('tr');
+ table.appendChild(tr);
+ let input = document.createElement('input');
+ document.documentElement.appendChild(input);
+
+ let img = document.createElement('img');
+ input.appendChild(img);
+ img.contentEditable = 'true'
+ tr.appendChild(img);
+ img.offsetParent;
+
+ // Since table's cell is selected by the following, it will show
+ // object resizer that is anonymous element.
+ window.getSelection().selectAllChildren(tr);
+ // Document.adoptNode will remove anonymous element of object resizer
+ // and it shouldn't cause crash
+ document.implementation.createDocument('', '').adoptNode(table);
+ </script>
+ </head>
+</html>
+
--- a/editor/libeditor/crashtests/crashtests.list
+++ b/editor/libeditor/crashtests/crashtests.list
@@ -73,8 +73,9 @@ load 1317704.html
load 1317718.html
load 1324505.html
needs-focus load 1343918.html
load 1345015.html
load 1348851.html
load 1350772.html
load 1366176.html
load 1375131.html
+load 1383755.html
