1 files changed, 26 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/1383755.html b/editor/libeditor/crashtests/1383755.html
new file mode 100644
index 0000000000..3cbfe08d17
--- /dev/null
+++ b/editor/libeditor/crashtests/1383755.html
@@ -0,0 +1,26 @@
+<html>
+  <head>
+    <script type="application/javascript">
+      let table = document.createElement('table');
+      document.documentElement.appendChild(table);
+      let tr = document.createElement('tr');
+      table.appendChild(tr);
+      let input = document.createElement('input');
+      document.documentElement.appendChild(input);
+
+      let img = document.createElement('img');
+      input.appendChild(img);
+      img.contentEditable = 'true'
+      tr.appendChild(img);
+      img.offsetParent;
+
+      // Since table's cell is selected by the following, it will show
+      // object resizer that is anonymous element.
+      window.getSelection().selectAllChildren(tr);
+      // Document.adoptNode will remove anonymous element of object resizer
+      // and it shouldn't cause crash
+      document.implementation.createDocument('', '').adoptNode(table);
+    </script>
+  </head>
+</html>
+