1 files changed, 33 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/1375131.html b/editor/libeditor/crashtests/1375131.html
new file mode 100644
index 0000000000..4060cf3d4c
--- /dev/null
+++ b/editor/libeditor/crashtests/1375131.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <script type="application/javascript">
+      document.designMode = 'on';
+
+      let div = document.createElement('div');
+      let p = document.createElement('p');
+      document.documentElement.appendChild(div);
+      document.documentElement.appendChild(
+        document.createElement('body'));
+      document.documentElement.appendChild(p);
+      document.execCommand('insertimage', false, 'http://localhost/');
+      document.execCommand('insertparagraph', false, null);
+
+      document.elementFromPoint(0, 0);
+
+      let selection = window.getSelection();
+      selection.modify('extend', 'forward', 'character');
+
+      let range = document.createRange();
+      range.selectNode(p);
+      selection.addRange(range);
+      range.setStart(div, 0);
+
+      range = document.createRange();
+      range.selectNode(p);
+      selection.addRange(range);
+
+      document.execCommand('delete', false, null);
+    </script>
+  </head>
+</html>