1 files changed, 30 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/420439.html b/editor/libeditor/crashtests/420439.html
new file mode 100644
index 0000000000..d151ac65f1
--- /dev/null
+++ b/editor/libeditor/crashtests/420439.html
@@ -0,0 +1,30 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  function x()
+  {
+    document.removeEventListener("DOMAttrModified", x);
+    document.execCommand("backcolor", false, "green");
+  }
+
+  document.getElementById("td").focus();
+
+  document.addEventListener("DOMAttrModified", x);
+  try { 
+    document.execCommand("subscript", false, null); 
+  } catch(e) { 
+  }
+  document.removeEventListener("DOMAttrModified", x);
+}
+
+</script>
+</head>
+
+<body contenteditable="true" onload="setTimeout(boom, 30);">
+<table><tbody contenteditable="false"><tr><td contenteditable="true" id="td"></td></tr></tbody></table>
+</body>
+
+</html>