1 files changed, 21 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/1581246.html b/editor/libeditor/crashtests/1581246.html
new file mode 100644
index 0000000000..e9c472c7d9
--- /dev/null
+++ b/editor/libeditor/crashtests/1581246.html
@@ -0,0 +1,21 @@
+<script>
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node in the <textarea> which is the last child of the <body>.
+  // However, it may be omitted by the parser.  Therefore, this test tries to
+  // check the text node, but if it does not exist, uses the <textarea>.
+  const textarea = document.querySelector("textarea");
+  const textareaOrTextNode = textarea.lastChild ? textarea.lastChild : textarea;
+  getSelection().collapse(textareaOrTextNode, textareaOrTextNode.length);
+  document.querySelector("script").appendChild(
+    document.querySelector("li[contenteditable=false]")
+  );
+  document.execCommand("indent");
+  document.execCommand("delete");
+}
+</script>
+<body onload="onLoad()">
+<ul contenteditable>
+<li contenteditable="false">
+<textarea autofocus>
+</textarea>></li></ul></body>