1 files changed, 22 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/1699866.html b/editor/libeditor/crashtests/1699866.html
new file mode 100644
index 0000000000..f8d700ec9c
--- /dev/null
+++ b/editor/libeditor/crashtests/1699866.html
@@ -0,0 +1,22 @@
+<script>
+window.onload = () => {
+  const font = document.querySelector("font");
+  // For emulating traditional behavior, collapse Selection to end of the
+  // text node in the <font>.
+  getSelection().collapse(font.lastChild, font.lastChild.length);
+  const meta = document.querySelector("meta");
+  meta.style.setProperty(
+    "text-decoration",
+    "overline underline line-through"
+  );
+  meta.appendChild(font);
+  document.execCommand("selectAll");
+  getSelection().extend(meta, 0);
+  document.execCommand("underline");
+}
+</script>
+<ins contenteditable>
+a
+<meta></meta>
+<font>
+</font></ins></body>