1 files changed, 31 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/1677566.html b/editor/libeditor/crashtests/1677566.html
new file mode 100644
index 0000000000..1546bb4601
--- /dev/null
+++ b/editor/libeditor/crashtests/1677566.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+  const table = document.querySelector("table");
+  // For emulating traditional behavior, collapse Selection to end of the
+  // text node after the <p> (<table> does not close the <p>).
+  getSelection().collapse(
+    document.body.lastChild,
+    document.body.lastChild.length
+  );
+  const paragraph = document.querySelector("p");
+  document.documentElement.contentEditable = true;
+  getSelection().setBaseAndExtent(document, 0, document.documentElement, 1);
+  paragraph.contentEditable = false;
+  table.insertRow(0);
+  document.execCommand("forwardDelete");
+});
+</script>
+</head>
+<p>
+    <del>
+        <button contenteditable>
+        </button>
+        <table>
+        </table>
+    </del>
+</p>
+</body>
+</html>