1 files changed, 29 insertions, 0 deletions
diff --git a/testing/web-platform/tests/editing/crashtests/insertText-nested-by-DOMSubtreeModified.html b/testing/web-platform/tests/editing/crashtests/insertText-nested-by-DOMSubtreeModified.html
new file mode 100644
index 0000000000..45b0e67ed4
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/insertText-nested-by-DOMSubtreeModified.html
@@ -0,0 +1,29 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  const output = document.querySelector("output");
+  const table = document.querySelector("table");
+  table.addEventListener("DOMSubtreeModified", () => {
+    document.execCommand("bold");
+    document.execCommand("hiliteColor", false, "white");
+    output.appendChild(table);
+    document.execCommand("forwardDelete");
+    table.setAttribute("onwebkitsourceclose", "foo()");
+    document.execCommand("insertText", false, "a");
+  });
+  document.execCommand("selectAll");
+  table.insertRow();
+});
+</script>
+</head>
+<body>
+<canvas contenteditable>
+<output>
+<table tabindex="0" autofocus></table>
+</output>
+</canvas>
+</body>
+</html>