gecko-dev/dom/html/crashtests/1386905.html
Xidorn Quan dd399af4be Bug 1386905 - Move away mRuleNode in nsTextEditorState::UnbindFromFrame before storing the value into text buffer. r=Ehsan
Otherwise SetValue may think it's still safe to notify, while it isn't.

MozReview-Commit-ID: 6a3or1WXWAq

--HG--
extra : rebase_source : 9ffde09a1c1adf0bc7b47c9b10d2730f9d9de37e
2017-08-04 14:18:41 +10:00

14 lines
345 B
HTML

<!DOCTYPE html>
<html>
<head>
<script>
document.documentElement.getBoundingClientRect()
document.documentElement.innerHTML = "<input placeholder=e type=number readonly>"
document.designMode = "on"
document.execCommand("inserttext", false, "")
document.designMode = "off"
document.documentElement.style.display = 'none'
</script>
</head>
</html>