<!DOCTYPE html>
<script src="../../resources/js-test.js"></script>

<div id="root">
<span id="div1"></span>
</div>

<!-- This is a minified version of the clusterfuzz test case at https://code.google.com/p/chromium/issues/detail?id=507413 -->
<script>

description("Generated by cluster-fuzz. This test passes if it doesn't crash.");

// Here's explanation of what happens (before fix is in).
// - execCommand("SelectAll") does 2 things
//   1. triggers "selectstart" event handler.
//   2. until the event handler finishes, the following events are queued.
//     - DOMNodeInserted for #text "A"
//     - DOMNodeInserted for #text "C"
//     - DOMNodeInserted for <option> (outer one)
// - Once "selectstart" handler finishes, the following occurs.
//     - at entry, event.srcElement is <body>
//     - DOMNodeInserted for #text "A" is dispatched.
//     - "A"'s innerHTML ("<a><option>C</option></a>") is replaced with "ABC".
//     - <a> element is destructed.
//     - <option> (inner one) is destructed. <option>'s shadow root is detached at this point.
//     - DOMNodeInserted for #text "C" is dispatched.
//     - event.path calculation touches the #text's parent and get nullptr dereference.

document.addEventListener("selectstart", function() {
  var oElement = event.srcElement;
  oElement.innerHTML = "<option>A<a><option>C</option></a></option>";
}
);

document.addEventListener("DOMNodeInserted", function() {
  var oElement = event.srcElement;
  oElement.innerHTML = "ABC";
});

document.execCommand("SelectAll")
</script>