gecko-dev/dom/html/crashtests/1386905.html

<!DOCTYPE html>
<html>
<head>
<script>
document.documentElement.getBoundingClientRect()
document.documentElement.innerHTML = "<input placeholder=e type=number readonly>"
document.designMode = "on"
document.execCommand("inserttext", false, "")
document.designMode = "off"
document.documentElement.style.display = 'none'
</script>
</head>
</html>
Bug 1386905 - Move away mRuleNode in nsTextEditorState::UnbindFromFrame before storing the value into text buffer. r=Ehsan Otherwise SetValue may think it's still safe to notify, while it isn't. MozReview-Commit-ID: 6a3or1WXWAq --HG-- extra : rebase_source : 9ffde09a1c1adf0bc7b47c9b10d2730f9d9de37e 2017-08-04 07:18:41 +03:00			`<!DOCTYPE html>`
			`<html>`
			`<head>`
			`<script>`
			`document.documentElement.getBoundingClientRect()`
			`document.documentElement.innerHTML = "<input placeholder=e type=number readonly>"`
			`document.designMode = "on"`
			`document.execCommand("inserttext", false, "")`
			`document.designMode = "off"`
			`document.documentElement.style.display = 'none'`
			`</script>`
			`</head>`
			`</html>`