1 files changed, 31 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/1402904.html b/editor/libeditor/crashtests/1402904.html
new file mode 100644
index 0000000000..96880ce4a3
--- /dev/null
+++ b/editor/libeditor/crashtests/1402904.html
@@ -0,0 +1,31 @@
+<script>
+function jsfuzzer() {
+  var option = document.getElementById("option");
+  option.addEventListener("click", () => {
+    document.execCommand("forwardDelete", false);
+  });
+  var li2 = document.getElementById("li2");
+  li2.addEventListener("DOMNodeInserted", () => {
+    option.click();
+  });
+  var select = document.getElementById("select");
+  select.parentElement.setAttribute("onpageshow", "onPageShow()");
+}
+
+function onPageShow() {
+  var li1 = document.getElementById("li1");
+  li1.addEventListener("DOMSubtreeModified", () => {
+    document.execCommand("selectAll", false);
+    document.execCommand("indent", false);
+  });
+  li1.appendChild(document.createElement("legend"));
+}
+</script>
+<body onload=jsfuzzer()>
+<select id="select">
+<option id="option"></option>
+</select>
+<li id="li1"></li>
+<ul contenteditable="true">
+<li id="li2"></li>
+<embed>a;#2