1 files changed, 23 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/1405897.html b/editor/libeditor/crashtests/1405897.html
new file mode 100644
index 0000000000..60118628b5
--- /dev/null
+++ b/editor/libeditor/crashtests/1405897.html
@@ -0,0 +1,23 @@
+<style>
+* { position: absolute; }
+</style>
+<script>
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node in the <iframe> which is the last child of the <body>.  Note that
+  // <iframe> is treated as a container in HTMLEditor.
+  const iframe = document.querySelector("iframe");
+  getSelection().collapse(iframe.firstChild, iframe.firstChild.length);
+  document.querySelector("del").addEventListener("DOMSubtreeModified", () => {
+    document.execCommand("italic");
+    document.execCommand("selectAll");
+  });
+  const anchor = document.querySelector("a[contenteditable]");
+  anchor.replaceChild(iframe, anchor.childNodes[0]);
+}
+</script>
+<body onload="onLoad()">
+<a contenteditable>
+<del>
+<iframe>
+</body>
+\ No newline at end of file