From 26a029d407be480d791972afb5975cf62c9360a6 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Fri, 19 Apr 2024 02:47:55 +0200
Subject: Adding upstream version 124.0.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 editor/libeditor/crashtests/1057677.html    |   9 +++
 editor/libeditor/crashtests/1128787.html    |  17 ++++
 editor/libeditor/crashtests/1134545.html    |  26 +++++++
 editor/libeditor/crashtests/1158452.html    |  10 +++
 editor/libeditor/crashtests/1158651.html    |  18 +++++
 editor/libeditor/crashtests/1244894.xhtml   |  21 +++++
 editor/libeditor/crashtests/1264921.html    |   1 +
 editor/libeditor/crashtests/1272490.html    |  20 +++++
 editor/libeditor/crashtests/1274050.html    |  17 ++++
 editor/libeditor/crashtests/1317704.html    |  42 ++++++++++
 editor/libeditor/crashtests/1317718.html    |  14 ++++
 editor/libeditor/crashtests/1324505.html    |  24 ++++++
 editor/libeditor/crashtests/1343918.html    |  21 +++++
 editor/libeditor/crashtests/1344097.html    |  20 +++++
 editor/libeditor/crashtests/1345015.html    |  28 +++++++
 editor/libeditor/crashtests/1348851.html    |  19 +++++
 editor/libeditor/crashtests/1350772.html    |  16 ++++
 editor/libeditor/crashtests/1364133.html    |  42 ++++++++++
 editor/libeditor/crashtests/1366176.html    |  30 +++++++
 editor/libeditor/crashtests/1375131.html    |  33 ++++++++
 editor/libeditor/crashtests/1381541.html    |  20 +++++
 editor/libeditor/crashtests/1383747.html    |  15 ++++
 editor/libeditor/crashtests/1383755.html    |  26 +++++++
 editor/libeditor/crashtests/1383763.html    |  17 ++++
 editor/libeditor/crashtests/1384161.html    |  17 ++++
 editor/libeditor/crashtests/1388075.html    |  60 ++++++++++++++
 editor/libeditor/crashtests/1393171.html    |  10 +++
 editor/libeditor/crashtests/1402196.html    |  29 +++++++
 editor/libeditor/crashtests/1402469.html    |  22 ++++++
 editor/libeditor/crashtests/1402526.html    |  24 ++++++
 editor/libeditor/crashtests/1402904.html    |  38 +++++++++
 editor/libeditor/crashtests/1405747.html    |  40 ++++++++++
 editor/libeditor/crashtests/1405897.html    |  23 ++++++
 editor/libeditor/crashtests/1408170.html    |  40 ++++++++++
 editor/libeditor/crashtests/1414581.html    |  31 ++++++++
 editor/libeditor/crashtests/1415231.html    |  26 +++++++
 editor/libeditor/crashtests/1423767.html    |  17 ++++
 editor/libeditor/crashtests/1423776.html    |  25 ++++++
 editor/libeditor/crashtests/1424450.html    |  51 ++++++++++++
 editor/libeditor/crashtests/1425091.html    |  25 ++++++
 editor/libeditor/crashtests/1426709.html    |  27 +++++++
 editor/libeditor/crashtests/1429523.html    |  18 +++++
 editor/libeditor/crashtests/1429523.xhtml   |  18 +++++
 editor/libeditor/crashtests/1441619.html    |  12 +++
 editor/libeditor/crashtests/1443664.html    |  15 ++++
 editor/libeditor/crashtests/1444630.html    |  29 +++++++
 editor/libeditor/crashtests/1446451.html    |  13 ++++
 editor/libeditor/crashtests/1464251.html    |  25 ++++++
 editor/libeditor/crashtests/1470926.html    |   9 +++
 editor/libeditor/crashtests/1474978.html    |  21 +++++
 editor/libeditor/crashtests/1517028.html    |  23 ++++++
 editor/libeditor/crashtests/1525481.html    |  23 ++++++
 editor/libeditor/crashtests/1533913.html    |  19 +++++
 editor/libeditor/crashtests/1534394.html    |  29 +++++++
 editor/libeditor/crashtests/1547897.html    |  25 ++++++
 editor/libeditor/crashtests/1547898.html    |  16 ++++
 editor/libeditor/crashtests/1556799.html    |  18 +++++
 editor/libeditor/crashtests/1574544.html    |  17 ++++
 editor/libeditor/crashtests/1578916.html    |  28 +++++++
 editor/libeditor/crashtests/1579934.html    |  39 ++++++++++
 editor/libeditor/crashtests/1581246.html    |  21 +++++
 editor/libeditor/crashtests/1596516.html    |  18 +++++
 editor/libeditor/crashtests/1605741.html    |  14 ++++
 editor/libeditor/crashtests/1613521.html    |  16 ++++
 editor/libeditor/crashtests/1618906.html    |  17 ++++
 editor/libeditor/crashtests/1623166.html    |  21 +++++
 editor/libeditor/crashtests/1623913.html    |  30 +++++++
 editor/libeditor/crashtests/1624005.html    |  14 ++++
 editor/libeditor/crashtests/1624007.html    |  19 +++++
 editor/libeditor/crashtests/1624011.html    |  12 +++
 editor/libeditor/crashtests/1626002.html    |  27 +++++++
 editor/libeditor/crashtests/1636541.html    |  14 ++++
 editor/libeditor/crashtests/1644903.html    |  19 +++++
 editor/libeditor/crashtests/1645983-1.html  |  11 +++
 editor/libeditor/crashtests/1645983-2.html  |  14 ++++
 editor/libeditor/crashtests/1648564.html    |  29 +++++++
 editor/libeditor/crashtests/1655508.html    |  34 ++++++++
 editor/libeditor/crashtests/1655539.html    |  15 ++++
 editor/libeditor/crashtests/1655988.html    |  29 +++++++
 editor/libeditor/crashtests/1659717.html    |  14 ++++
 editor/libeditor/crashtests/1663725.html    |  18 +++++
 editor/libeditor/crashtests/1666556.html    |  28 +++++++
 editor/libeditor/crashtests/1677566.html    |  31 ++++++++
 editor/libeditor/crashtests/1691051.html    |  15 ++++
 editor/libeditor/crashtests/1699866.html    |  22 ++++++
 editor/libeditor/crashtests/1701348.html    |  10 +++
 editor/libeditor/crashtests/1707630.html    |  16 ++++
 editor/libeditor/crashtests/336081-1.xhtml  |  52 +++++++++++++
 editor/libeditor/crashtests/403965-1.xhtml  |   7 ++
 editor/libeditor/crashtests/428489-1.html   |   8 ++
 editor/libeditor/crashtests/429586-1.html   |   8 ++
 editor/libeditor/crashtests/431086-1.xhtml  |  22 ++++++
 editor/libeditor/crashtests/475132-1.xhtml  |  21 +++++
 editor/libeditor/crashtests/503709-1.xhtml  |  11 +++
 editor/libeditor/crashtests/513375-1.xhtml  |  19 +++++
 editor/libeditor/crashtests/535632-1.xhtml  |   1 +
 editor/libeditor/crashtests/574558-1.xhtml  |  15 ++++
 editor/libeditor/crashtests/580151-1.xhtml  |  26 +++++++
 editor/libeditor/crashtests/582138-1.xhtml  |  10 +++
 editor/libeditor/crashtests/633709.xhtml    |  68 ++++++++++++++++
 editor/libeditor/crashtests/639736-1.xhtml  |  19 +++++
 editor/libeditor/crashtests/713427-2.xhtml  |  28 +++++++
 editor/libeditor/crashtests/766360.html     |  18 +++++
 editor/libeditor/crashtests/766387.html     |  21 +++++
 editor/libeditor/crashtests/766413.html     |  42 ++++++++++
 editor/libeditor/crashtests/766795.html     |  21 +++++
 editor/libeditor/crashtests/766845.xhtml    |  27 +++++++
 editor/libeditor/crashtests/767169.html     |  23 ++++++
 editor/libeditor/crashtests/768748.html     |  16 ++++
 editor/libeditor/crashtests/768765.html     |  36 +++++++++
 editor/libeditor/crashtests/769008-1.html   |  23 ++++++
 editor/libeditor/crashtests/769967.xhtml    |  16 ++++
 editor/libeditor/crashtests/771749.html     |  21 +++++
 editor/libeditor/crashtests/772282.html     |  27 +++++++
 editor/libeditor/crashtests/776323.html     |  18 +++++
 editor/libeditor/crashtests/793866.html     |  21 +++++
 editor/libeditor/crashtests/848644.html     |   2 +
 editor/libeditor/crashtests/crashtests.list | 117 ++++++++++++++++++++++++++++
 118 files changed, 2700 insertions(+)
 create mode 100644 editor/libeditor/crashtests/1057677.html
 create mode 100644 editor/libeditor/crashtests/1128787.html
 create mode 100644 editor/libeditor/crashtests/1134545.html
 create mode 100644 editor/libeditor/crashtests/1158452.html
 create mode 100644 editor/libeditor/crashtests/1158651.html
 create mode 100644 editor/libeditor/crashtests/1244894.xhtml
 create mode 100644 editor/libeditor/crashtests/1264921.html
 create mode 100644 editor/libeditor/crashtests/1272490.html
 create mode 100644 editor/libeditor/crashtests/1274050.html
 create mode 100644 editor/libeditor/crashtests/1317704.html
 create mode 100644 editor/libeditor/crashtests/1317718.html
 create mode 100644 editor/libeditor/crashtests/1324505.html
 create mode 100644 editor/libeditor/crashtests/1343918.html
 create mode 100644 editor/libeditor/crashtests/1344097.html
 create mode 100644 editor/libeditor/crashtests/1345015.html
 create mode 100644 editor/libeditor/crashtests/1348851.html
 create mode 100644 editor/libeditor/crashtests/1350772.html
 create mode 100644 editor/libeditor/crashtests/1364133.html
 create mode 100644 editor/libeditor/crashtests/1366176.html
 create mode 100644 editor/libeditor/crashtests/1375131.html
 create mode 100644 editor/libeditor/crashtests/1381541.html
 create mode 100644 editor/libeditor/crashtests/1383747.html
 create mode 100644 editor/libeditor/crashtests/1383755.html
 create mode 100644 editor/libeditor/crashtests/1383763.html
 create mode 100644 editor/libeditor/crashtests/1384161.html
 create mode 100644 editor/libeditor/crashtests/1388075.html
 create mode 100644 editor/libeditor/crashtests/1393171.html
 create mode 100644 editor/libeditor/crashtests/1402196.html
 create mode 100644 editor/libeditor/crashtests/1402469.html
 create mode 100644 editor/libeditor/crashtests/1402526.html
 create mode 100644 editor/libeditor/crashtests/1402904.html
 create mode 100644 editor/libeditor/crashtests/1405747.html
 create mode 100644 editor/libeditor/crashtests/1405897.html
 create mode 100644 editor/libeditor/crashtests/1408170.html
 create mode 100644 editor/libeditor/crashtests/1414581.html
 create mode 100644 editor/libeditor/crashtests/1415231.html
 create mode 100644 editor/libeditor/crashtests/1423767.html
 create mode 100644 editor/libeditor/crashtests/1423776.html
 create mode 100644 editor/libeditor/crashtests/1424450.html
 create mode 100644 editor/libeditor/crashtests/1425091.html
 create mode 100644 editor/libeditor/crashtests/1426709.html
 create mode 100644 editor/libeditor/crashtests/1429523.html
 create mode 100644 editor/libeditor/crashtests/1429523.xhtml
 create mode 100644 editor/libeditor/crashtests/1441619.html
 create mode 100644 editor/libeditor/crashtests/1443664.html
 create mode 100644 editor/libeditor/crashtests/1444630.html
 create mode 100644 editor/libeditor/crashtests/1446451.html
 create mode 100644 editor/libeditor/crashtests/1464251.html
 create mode 100644 editor/libeditor/crashtests/1470926.html
 create mode 100644 editor/libeditor/crashtests/1474978.html
 create mode 100644 editor/libeditor/crashtests/1517028.html
 create mode 100644 editor/libeditor/crashtests/1525481.html
 create mode 100644 editor/libeditor/crashtests/1533913.html
 create mode 100644 editor/libeditor/crashtests/1534394.html
 create mode 100644 editor/libeditor/crashtests/1547897.html
 create mode 100644 editor/libeditor/crashtests/1547898.html
 create mode 100644 editor/libeditor/crashtests/1556799.html
 create mode 100644 editor/libeditor/crashtests/1574544.html
 create mode 100644 editor/libeditor/crashtests/1578916.html
 create mode 100644 editor/libeditor/crashtests/1579934.html
 create mode 100644 editor/libeditor/crashtests/1581246.html
 create mode 100644 editor/libeditor/crashtests/1596516.html
 create mode 100644 editor/libeditor/crashtests/1605741.html
 create mode 100644 editor/libeditor/crashtests/1613521.html
 create mode 100644 editor/libeditor/crashtests/1618906.html
 create mode 100644 editor/libeditor/crashtests/1623166.html
 create mode 100644 editor/libeditor/crashtests/1623913.html
 create mode 100644 editor/libeditor/crashtests/1624005.html
 create mode 100644 editor/libeditor/crashtests/1624007.html
 create mode 100644 editor/libeditor/crashtests/1624011.html
 create mode 100644 editor/libeditor/crashtests/1626002.html
 create mode 100644 editor/libeditor/crashtests/1636541.html
 create mode 100644 editor/libeditor/crashtests/1644903.html
 create mode 100644 editor/libeditor/crashtests/1645983-1.html
 create mode 100644 editor/libeditor/crashtests/1645983-2.html
 create mode 100644 editor/libeditor/crashtests/1648564.html
 create mode 100644 editor/libeditor/crashtests/1655508.html
 create mode 100644 editor/libeditor/crashtests/1655539.html
 create mode 100644 editor/libeditor/crashtests/1655988.html
 create mode 100644 editor/libeditor/crashtests/1659717.html
 create mode 100644 editor/libeditor/crashtests/1663725.html
 create mode 100644 editor/libeditor/crashtests/1666556.html
 create mode 100644 editor/libeditor/crashtests/1677566.html
 create mode 100644 editor/libeditor/crashtests/1691051.html
 create mode 100644 editor/libeditor/crashtests/1699866.html
 create mode 100644 editor/libeditor/crashtests/1701348.html
 create mode 100644 editor/libeditor/crashtests/1707630.html
 create mode 100644 editor/libeditor/crashtests/336081-1.xhtml
 create mode 100644 editor/libeditor/crashtests/403965-1.xhtml
 create mode 100644 editor/libeditor/crashtests/428489-1.html
 create mode 100644 editor/libeditor/crashtests/429586-1.html
 create mode 100644 editor/libeditor/crashtests/431086-1.xhtml
 create mode 100644 editor/libeditor/crashtests/475132-1.xhtml
 create mode 100644 editor/libeditor/crashtests/503709-1.xhtml
 create mode 100644 editor/libeditor/crashtests/513375-1.xhtml
 create mode 100644 editor/libeditor/crashtests/535632-1.xhtml
 create mode 100644 editor/libeditor/crashtests/574558-1.xhtml
 create mode 100644 editor/libeditor/crashtests/580151-1.xhtml
 create mode 100644 editor/libeditor/crashtests/582138-1.xhtml
 create mode 100644 editor/libeditor/crashtests/633709.xhtml
 create mode 100644 editor/libeditor/crashtests/639736-1.xhtml
 create mode 100644 editor/libeditor/crashtests/713427-2.xhtml
 create mode 100644 editor/libeditor/crashtests/766360.html
 create mode 100644 editor/libeditor/crashtests/766387.html
 create mode 100644 editor/libeditor/crashtests/766413.html
 create mode 100644 editor/libeditor/crashtests/766795.html
 create mode 100644 editor/libeditor/crashtests/766845.xhtml
 create mode 100644 editor/libeditor/crashtests/767169.html
 create mode 100644 editor/libeditor/crashtests/768748.html
 create mode 100644 editor/libeditor/crashtests/768765.html
 create mode 100644 editor/libeditor/crashtests/769008-1.html
 create mode 100644 editor/libeditor/crashtests/769967.xhtml
 create mode 100644 editor/libeditor/crashtests/771749.html
 create mode 100644 editor/libeditor/crashtests/772282.html
 create mode 100644 editor/libeditor/crashtests/776323.html
 create mode 100644 editor/libeditor/crashtests/793866.html
 create mode 100644 editor/libeditor/crashtests/848644.html
 create mode 100644 editor/libeditor/crashtests/crashtests.list

(limited to 'editor/libeditor/crashtests')

diff --git a/editor/libeditor/crashtests/1057677.html b/editor/libeditor/crashtests/1057677.html
new file mode 100644
index 0000000000..d0b9497a5a
--- /dev/null
+++ b/editor/libeditor/crashtests/1057677.html
@@ -0,0 +1,9 @@
+<html><body></body><script>
+document.designMode = "on";
+var hrElem = document.createElement("HR");
+var select = window.getSelection();
+document.body.appendChild(hrElem);
+select.collapse(hrElem,0);
+document.execCommand("InsertHTML", false, "<div>foo</div><div>bar</div>");
+</script>
+</html>
diff --git a/editor/libeditor/crashtests/1128787.html b/editor/libeditor/crashtests/1128787.html
new file mode 100644
index 0000000000..fc6bff0972
--- /dev/null
+++ b/editor/libeditor/crashtests/1128787.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Bug 1128787</title>
+</head>
+<body>
+  <input type="button"/>
+  <script>
+    window.onload = function () {
+        document.designMode = "on";
+    }
+    var input = document.getElementsByTagName("input")[0];
+    input.focus();
+    input.type = "text";
+  </script>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1134545.html b/editor/libeditor/crashtests/1134545.html
new file mode 100644
index 0000000000..d09fd6beb3
--- /dev/null
+++ b/editor/libeditor/crashtests/1134545.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<!-- saved from url=(0065)https://bug1134545.bugzilla.mozilla.org/attachment.cgi?id=8566418 -->
+<html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
+<script>
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text at end of the <body>.
+  getSelection().collapse(
+    document.body.lastChild,
+    document.body.lastChild.length
+  );
+  const textNode = document.createTextNode(" ");
+  const editingHost = document.querySelector("div[contenteditable]");
+  editingHost.appendChild(textNode);
+  editingHost.setAttribute('contenteditable', "true");
+  textNode.remove();
+  getSelection().selectAllChildren(textNode);
+  document.execCommand("increasefontsize");
+}
+</script>
+</head>
+<body onload="onLoad();">
+<div contenteditable></div>
+
+
+</body></html>
\ No newline at end of file
diff --git a/editor/libeditor/crashtests/1158452.html b/editor/libeditor/crashtests/1158452.html
new file mode 100644
index 0000000000..56c74abd61
--- /dev/null
+++ b/editor/libeditor/crashtests/1158452.html
@@ -0,0 +1,10 @@
+
+<div>
+<div>
+aaaaaaa
+</script>
+<script type="text/javascript"> 
+document.designMode = "on"
+window.getSelection().modify("extend", "backward", "line")
+document.execCommand("increasefontsize","",null);
+</script>
diff --git a/editor/libeditor/crashtests/1158651.html b/editor/libeditor/crashtests/1158651.html
new file mode 100644
index 0000000000..27278b5234
--- /dev/null
+++ b/editor/libeditor/crashtests/1158651.html
@@ -0,0 +1,18 @@
+<script>
+onload = function() {
+  var testContainer = document.createElement("span");
+  testContainer.contentEditable = true;
+  document.body.appendChild(testContainer);
+
+  function queryFormatBlock(content)
+  {
+    testContainer.innerHTML = content;
+    while (testContainer.firstChild)
+        testContainer = testContainer.firstChild;
+    window.getSelection().collapse(testContainer, 0);
+    document.queryCommandValue('formatBlock');
+  }
+
+  queryFormatBlock('<ol>hello</ol>');
+};
+</script>
diff --git a/editor/libeditor/crashtests/1244894.xhtml b/editor/libeditor/crashtests/1244894.xhtml
new file mode 100644
index 0000000000..89a24751e9
--- /dev/null
+++ b/editor/libeditor/crashtests/1244894.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+    document.designMode = 'on';
+    document.execCommand("indent", false, null);
+    document.execCommand("insertText", false, "a");
+    document.execCommand("forwardDelete", false, null);
+    document.execCommand("justifyfull", false, null);
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+</head>
+
+<body> <span class="v"></span></body><body><input type="file" /></body>
+
+</html>
diff --git a/editor/libeditor/crashtests/1264921.html b/editor/libeditor/crashtests/1264921.html
new file mode 100644
index 0000000000..b53fcb5fd4
--- /dev/null
+++ b/editor/libeditor/crashtests/1264921.html
@@ -0,0 +1 @@
+<body style=display:table-footer-group onload=d=document;h=d.all[0];h.appendChild(d.createElement("input"));h.appendChild(d.createElement("iframe"));d.designMode="on">
\ No newline at end of file
diff --git a/editor/libeditor/crashtests/1272490.html b/editor/libeditor/crashtests/1272490.html
new file mode 100644
index 0000000000..2a8f1d9f9c
--- /dev/null
+++ b/editor/libeditor/crashtests/1272490.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+window.onload = function () {
+  var childDocument = document.getElementsByTagName("iframe")[0].contentDocument;
+  childDocument.designMode = "on";
+  function onAttrModified(aEvent) {
+    childDocument.removeEventListener("DOMAttrModified", onAttrModified);
+    // Remove the editor from document during executing "insertOrderedList".
+    document.body.innerHTML = "";
+  }
+  childDocument.addEventListener("DOMAttrModified", onAttrModified);
+  childDocument.execCommand("insertOrderedList", false, "1");
+}
+</script>
+</head>
+<body><iframe></iframe></body>
+</html>
diff --git a/editor/libeditor/crashtests/1274050.html b/editor/libeditor/crashtests/1274050.html
new file mode 100644
index 0000000000..5b7a5613ef
--- /dev/null
+++ b/editor/libeditor/crashtests/1274050.html
@@ -0,0 +1,17 @@
+<body>
+<table contenteditable></table>
+</body>
+<script>
+window.onload = function() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node at end of the <body>.
+  getSelection().collapse(
+    document.body.lastChild,
+    document.body.lastChild.length
+  );
+  document.execCommand("styleWithCSS", false, false);
+  document.designMode = "on";
+  document.execCommand("insertUnorderedList");
+  document.execCommand("justifyFull");
+};
+</script>
diff --git a/editor/libeditor/crashtests/1317704.html b/editor/libeditor/crashtests/1317704.html
new file mode 100644
index 0000000000..2f6d2820c3
--- /dev/null
+++ b/editor/libeditor/crashtests/1317704.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+addEventListener('DOMContentLoaded', () => {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node at end of the <body>.
+  getSelection().collapse(
+    document.body.lastChild,
+    document.body.lastChild.length
+  );
+  document.documentElement.className = 'lizard';
+  setTimeout(() => {
+    document.execCommand('selectAll');
+    document.designMode = 'on';
+    document.execCommand('removeformat');
+  }, 0);
+});
+</script>
+<style>
+.lizard {
+  -webkit-user-select: all;
+}
+* {
+  position: fixed;
+  display: table-column;
+}
+</style>
+</head>
+<body>
+<span>
+<span contenteditable>
+<span class=lizard></span>
+<span class=lizard></span>
+<span />
+</span>
+</span>
+</span>
+</span>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1317718.html b/editor/libeditor/crashtests/1317718.html
new file mode 100644
index 0000000000..892b8aee31
--- /dev/null
+++ b/editor/libeditor/crashtests/1317718.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<script>
+addEventListener('DOMContentLoaded', function() {
+  let root = document.documentElement;
+  while(root.firstChild) {
+    root.firstChild.remove();
+  }
+  document.designMode = 'on';
+  document.removeChild(document.documentElement);
+  document.execCommand('justifyleft', false, null);
+});
+</script>
+</html>
diff --git a/editor/libeditor/crashtests/1324505.html b/editor/libeditor/crashtests/1324505.html
new file mode 100644
index 0000000000..4872b9f05d
--- /dev/null
+++ b/editor/libeditor/crashtests/1324505.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<script>
+addEventListener("DOMContentLoaded", function(){
+  let root = document.documentElement;
+  while(root.firstChild) {
+    root.firstChild.remove();
+  }
+  let o_0 = document.createElement("body");
+  root.appendChild(o_0);
+  o_0.appendChild(document.createElement("table"));
+  o_0.appendChild(document.createElement("canvas"));
+  let o_1 = document.createElement("canvas");
+  o_0.appendChild(o_1);
+  o_1.setAttribute("contenteditable", "true");
+  setTimeout(function(){
+    document.execCommand("selectAll", false, "Marker felt");
+    document.designMode = 'on';
+    document.execCommand("insertorderedlist", false, null);
+    document.execCommand("insertorderedlist", false, null);
+  }, 0);
+});
+</script>
+</html>
diff --git a/editor/libeditor/crashtests/1343918.html b/editor/libeditor/crashtests/1343918.html
new file mode 100644
index 0000000000..24a3d9041f
--- /dev/null
+++ b/editor/libeditor/crashtests/1343918.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <script type="application/javascript">
+      let form = document.createElement('form');
+      let input1 = document.createElement('input');
+      let input2 = document.createElement('input');
+      document.documentElement.appendChild(form);
+      document.documentElement.appendChild(input1);
+      form.appendChild(input2);
+      form.contentEditable = true
+      input1.focus();
+
+      let range = document.createRange();
+      range.selectNode(input2);
+      window.getSelection().addRange(range);
+      document.execCommand("italic", false, null);
+    </script>
+  </head>
+  <body></body>
+</html>
diff --git a/editor/libeditor/crashtests/1344097.html b/editor/libeditor/crashtests/1344097.html
new file mode 100644
index 0000000000..7f76957c5a
--- /dev/null
+++ b/editor/libeditor/crashtests/1344097.html
@@ -0,0 +1,20 @@
+<html>
+    <head>
+        <script></script>
+        <script>
+            document.designMode = 'on';
+            o1 = window.getSelection();
+            o2 = document.createElement('code'); 
+            o3 = document.createElement('style');
+            o4 = document.createElement('style');
+            document.head.appendChild(o3);
+            o1.modify("move", "right", "character");
+            document.styleSheets[0].insertRule("* { position: absolute; }", 0);
+            document.head.appendChild(o4);
+            window.resizeTo(1,1);
+            document.documentElement.appendChild(o2);
+            o1.selectAllChildren(o2);
+        </script>
+    </head>
+    <body></body>
+</html>
diff --git a/editor/libeditor/crashtests/1345015.html b/editor/libeditor/crashtests/1345015.html
new file mode 100644
index 0000000000..3781469578
--- /dev/null
+++ b/editor/libeditor/crashtests/1345015.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <script type="application/javascript">
+      document.designMode = "on";
+      let selection = window.getSelection();
+
+      let foo = document.createElement('foo');
+      let div = document.createElement('div');
+      document.documentElement.appendChild(foo);
+      document.documentElement.appendChild(div);
+      foo.outerHTML = '<foo>';
+
+      let range = document.createRange();
+      range.selectNode(div);
+      selection.addRange(range);
+      range.setStart(foo, 0);
+
+      range = document.createRange();
+      range.selectNode(document.documentElement);
+      selection.addRange(range);
+
+      document.execCommand('insertparagraph', false, null);
+    </script>
+  </head>
+  <body>
+  </body>
+</html>
diff --git a/editor/libeditor/crashtests/1348851.html b/editor/libeditor/crashtests/1348851.html
new file mode 100644
index 0000000000..d618f049ee
--- /dev/null
+++ b/editor/libeditor/crashtests/1348851.html
@@ -0,0 +1,19 @@
+<!DOCTYPE>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+function boom(){
+  document.designMode = "on";
+  document.execCommand("insertlinebreak");
+  document.designMode = "off";
+  document.designMode = "on";
+  document.execCommand("insertunorderedlist");
+}
+addEventListener("DOMContentLoaded", boom);
+</script>
+</head>
+<body style="display:flex;">
+<!--comment-->
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1350772.html b/editor/libeditor/crashtests/1350772.html
new file mode 100644
index 0000000000..e20481527d
--- /dev/null
+++ b/editor/libeditor/crashtests/1350772.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+addEventListener("DOMContentLoaded", () => {
+  try {
+    document.designMode = 'on';
+    document.removeChild(document.documentElement);
+    document.appendChild(document.createElement("p"));
+    document.execCommand("insertParagraph", false, null);
+  } catch(e) {
+  }
+});
+</script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1364133.html b/editor/libeditor/crashtests/1364133.html
new file mode 100644
index 0000000000..a1d06fba98
--- /dev/null
+++ b/editor/libeditor/crashtests/1364133.html
@@ -0,0 +1,42 @@
+<html>
+  <head>
+    <script>
+      var tr = document.createElement('tr');
+      document.documentElement.appendChild(tr);
+
+      var a1 = document.createElement('a');
+      document.documentElement.appendChild(a1);
+      var a2 = document.createElement('a');
+      tr.appendChild(a2);
+
+      var a3 = document.createElement('a');
+      document.documentElement.appendChild(a3);
+
+      var a4 = document.createElement('a');
+      document.documentElement.appendChild(a4);
+
+      var a5 = document.createElement('a');
+      a1.appendChild(a5);
+
+      var input = document.createElement('input');
+      document.documentElement.appendChild(input);
+
+      a3.contentEditable = true;
+      a5.innerText = "xx";
+      a4.outerHTML = "";
+      input.select();
+
+      document.replaceChild(document.documentElement, document.documentElement);
+      window.find("x", false, false, false, false, false, false);
+
+      var range = document.createRange();
+      range.setStart(a1, 1);
+      window.getSelection().addRange(range);
+
+      document.designMode = "on";
+
+      range.selectNode(a2);
+      document.execCommand("forecolor", false, "-moz-default-background-color");
+    </script>
+  </head>
+</html>
diff --git a/editor/libeditor/crashtests/1366176.html b/editor/libeditor/crashtests/1366176.html
new file mode 100644
index 0000000000..cf6841c650
--- /dev/null
+++ b/editor/libeditor/crashtests/1366176.html
@@ -0,0 +1,30 @@
+<html>
+<head>
+	<script>
+
+	function go()
+	{
+		try { o114 = document.createElement('canvas'); } catch(e) {;}
+		try { o103 = (new DOMParser).parseFromString('/', 'text/html'); } catch(e) {;}
+		try { o217 = o103.all[1]; } catch(e) {;}
+		try { o253 = window.getSelection(); } catch(e) {;}
+
+		try { o270 = document.body.appendChild(document.createElement('a')); } catch(e) {;}
+
+		try { o301 = window.getSelection(); } catch(e) {;}
+		try { o314 = window.getSelection(); } catch(e) {;}
+		try { document.body.appendChild(o114); } catch(e) {;}
+		try { document.documentElement.appendChild(o217); } catch(e) {;}
+		try { document.body.appendChild(o270); } catch(e) {;}
+		try { o217.contentEditable = true } catch(e) {;}
+
+		try { o253.modify('move','forward','lineboundary'); } catch(e) {;}
+		try { o314.modify('extend','left','line'); } catch(e) {;}
+		try { o301.modify('extend','right','line'); } catch(e) {;}
+	}
+	</script>
+</head>
+<body onload="go();">
+	<plaintext></plaintext>
+</bdoy>
+</html>
diff --git a/editor/libeditor/crashtests/1375131.html b/editor/libeditor/crashtests/1375131.html
new file mode 100644
index 0000000000..4060cf3d4c
--- /dev/null
+++ b/editor/libeditor/crashtests/1375131.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <script type="application/javascript">
+      document.designMode = 'on';
+
+      let div = document.createElement('div');
+      let p = document.createElement('p');
+      document.documentElement.appendChild(div);
+      document.documentElement.appendChild(
+        document.createElement('body'));
+      document.documentElement.appendChild(p);
+      document.execCommand('insertimage', false, 'http://localhost/');
+      document.execCommand('insertparagraph', false, null);
+
+      document.elementFromPoint(0, 0);
+
+      let selection = window.getSelection();
+      selection.modify('extend', 'forward', 'character');
+
+      let range = document.createRange();
+      range.selectNode(p);
+      selection.addRange(range);
+      range.setStart(div, 0);
+
+      range = document.createRange();
+      range.selectNode(p);
+      selection.addRange(range);
+
+      document.execCommand('delete', false, null);
+    </script>
+  </head>
+</html>
diff --git a/editor/libeditor/crashtests/1381541.html b/editor/libeditor/crashtests/1381541.html
new file mode 100644
index 0000000000..8902e3d032
--- /dev/null
+++ b/editor/libeditor/crashtests/1381541.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <script type="application/javascript">
+      var editable = document.createElement('div');
+      document.documentElement.appendChild(editable);
+      editable.contentEditable = 'true';
+      var div = document.createElement('div');
+      document.documentElement.appendChild(div);
+      // Flush content
+      div.offsetLeft;
+      document.execCommand('styleWithCSS', false, true);
+
+      var range = new Range();
+      window.getSelection().addRange(range);
+      range.setStart(document.createTextNode(''), 0);
+      document.queryCommandState('backcolor');
+    </script>
+  </head>
+</html>
diff --git a/editor/libeditor/crashtests/1383747.html b/editor/libeditor/crashtests/1383747.html
new file mode 100644
index 0000000000..1c926cc7ea
--- /dev/null
+++ b/editor/libeditor/crashtests/1383747.html
@@ -0,0 +1,15 @@
+<html>
+  <head>
+    <script>
+      try { o1 = window.getSelection() } catch(e) { }
+      try { o2 = document.createElement('map') } catch(e) { };
+      try { o3 = document.createElement('select') } catch(e) { }
+      try { document.documentElement.appendChild(o2) } catch(e) { };
+      try { o2.contentEditable = 'true' } catch(e) { };
+      try { o2.offsetTop } catch(e) { };
+      try { document.replaceChild(document.implementation.createHTMLDocument().documentElement, document.documentElement); } catch(e) { }
+      try { document.documentElement.appendChild(o3) } catch(e) { }
+      try { o1.modify('extend', 'forward', 'word') } catch(e) { }
+    </script>
+  </head>
+</html>
\ No newline at end of file
diff --git a/editor/libeditor/crashtests/1383755.html b/editor/libeditor/crashtests/1383755.html
new file mode 100644
index 0000000000..3cbfe08d17
--- /dev/null
+++ b/editor/libeditor/crashtests/1383755.html
@@ -0,0 +1,26 @@
+<html>
+  <head>
+    <script type="application/javascript">
+      let table = document.createElement('table');
+      document.documentElement.appendChild(table);
+      let tr = document.createElement('tr');
+      table.appendChild(tr);
+      let input = document.createElement('input');
+      document.documentElement.appendChild(input);
+
+      let img = document.createElement('img');
+      input.appendChild(img);
+      img.contentEditable = 'true'
+      tr.appendChild(img);
+      img.offsetParent;
+
+      // Since table's cell is selected by the following, it will show
+      // object resizer that is anonymous element.
+      window.getSelection().selectAllChildren(tr);
+      // Document.adoptNode will remove anonymous element of object resizer
+      // and it shouldn't cause crash
+      document.implementation.createDocument('', '').adoptNode(table);
+    </script>
+  </head>
+</html>
+
diff --git a/editor/libeditor/crashtests/1383763.html b/editor/libeditor/crashtests/1383763.html
new file mode 100644
index 0000000000..a97d685368
--- /dev/null
+++ b/editor/libeditor/crashtests/1383763.html
@@ -0,0 +1,17 @@
+<xsl:stylesheet id='xsl'>
+<script id='script'>
+try { o1 = document.createElement('table') } catch(e) { }
+try { o3 = document.createElement('area') } catch(e) { }
+try { o4 = document.createElement('script'); } catch(e) { }
+try { o5 = document.getSelection() } catch(e) { }
+try { document.implementation.createDocument('', '', null).adoptNode(o1); } catch(e) { }
+try { o1.appendChild(o3) } catch(e) { }
+try { o5.addRange(new Range()); } catch(e) { }
+try { document.documentElement.appendChild(o4) } catch(e) { }
+try { o4.textContent = 'XX' } catch(e) { }
+try { o7 = o4.firstChild } catch(e) { }
+try { o4.parentNode.insertBefore(o7, o4); } catch(e) { }
+try { o5.modify('extend', 'forward', 'line') } catch(e) { }
+try { o5.selectAllChildren(o3) } catch(e) { }
+try { o7.splitText(1) } catch(e) { }
+</script>
\ No newline at end of file
diff --git a/editor/libeditor/crashtests/1384161.html b/editor/libeditor/crashtests/1384161.html
new file mode 100644
index 0000000000..c7d8ccc292
--- /dev/null
+++ b/editor/libeditor/crashtests/1384161.html
@@ -0,0 +1,17 @@
+<html>
+  <head>
+    <script>
+      try { o1 = document.createElement('caption') } catch(e) { }
+      try { o2 = document.createElement('select') } catch(e) { }
+      try { o3 = document.createElement('map') } catch(e) { }
+      try { o4 = window.getSelection() } catch(e) { }
+      try { document.documentElement.appendChild(o1) } catch(e) { }
+      try { o1.style.display = 'contents' } catch(e) { }
+      try { document.prepend(o2, document) } catch(e) { }
+      try { document.designMode = 'on'; } catch(e) { }
+      try { o3.ownerDocument.execCommand('outdent', false, null) } catch(e) { }
+      try { document.designMode = 'off'; } catch(e) { }
+      try { o4.extend(o2, 0) } catch(e) { }
+    </script>
+  </head>
+</html>
\ No newline at end of file
diff --git a/editor/libeditor/crashtests/1388075.html b/editor/libeditor/crashtests/1388075.html
new file mode 100644
index 0000000000..c539f97d57
--- /dev/null
+++ b/editor/libeditor/crashtests/1388075.html
@@ -0,0 +1,60 @@
+<html>
+<head>
+<script>
+try {
+  var style = document.createElement("style");
+} catch(e) {}
+try {
+  var output = document.createElement("output");
+} catch(e) {}
+try {
+  var input = document.createElement("input");
+} catch(e) {}
+try {
+  var script = document.createElement("script");
+} catch(e) {}
+try {
+  var clonedOutput = output.cloneNode(false);
+} catch(e) {}
+try {
+  document.documentElement.appendChild(style);
+} catch(e) {}
+try {
+  style.outerHTML = '<a contenteditable="true">';
+} catch(e) {}
+// For emulating the traditional behavior, collapse Selection to end of the
+// <body> which must be empty (<style> was added after the <body>).
+getSelection().collapse(document.body, document.body.childNodes.length);
+try {
+  document.documentElement.appendChild(input);
+} catch(e) {}
+try {
+  var text = document.createTextNode(" ");
+} catch(e) {}
+try {
+  script.appendChild(text);
+} catch(e) {}
+try {
+  document.documentElement.appendChild(script);
+} catch(e) {}
+try {
+  var selection = getSelection();
+} catch(e) {}
+try {
+  input.select();
+} catch(e) {}
+try {
+  document.replaceChild(document.documentElement, document.documentElement);
+} catch(e) {}
+try {
+  selection.setBaseAndExtent(text, 0, clonedOutput, 0);
+} catch(e) {}
+try {
+  document.designMode = "on";
+} catch(e) {}
+try {
+  document.execCommand("insertImage", false, "http://localhost/");
+} catch(e) {}
+</script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1393171.html b/editor/libeditor/crashtests/1393171.html
new file mode 100644
index 0000000000..0aca3304e7
--- /dev/null
+++ b/editor/libeditor/crashtests/1393171.html
@@ -0,0 +1,10 @@
+<script>
+window.onload=function(){
+  window.getSelection().addRange(document.createRange());
+  document.getElementById('a').appendChild(document.createElement('option'));
+  window.getSelection().modify('extend','backward','lineboundary');
+}
+</script>
+<div></div>
+<textarea autofocus='true'></textarea>
+<del id='a'>
diff --git a/editor/libeditor/crashtests/1402196.html b/editor/libeditor/crashtests/1402196.html
new file mode 100644
index 0000000000..8e0a7be0fe
--- /dev/null
+++ b/editor/libeditor/crashtests/1402196.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // <p> which is the deepest last child of the <body> (<spacer> can contain
+  // <p>).
+  getSelection().collapse(
+    document.querySelector("p"),
+    document.querySelector("p").childNodes.length
+  );
+  document.querySelector("spacer").addEventListener("DOMNodeInserted", () => {
+    document.querySelector("style").appendChild(
+      document.querySelector("table")
+    );
+    document.documentElement.classList.remove("reftest-wait");
+  });
+  document.execCommand("insertOrderedList");
+}
+</script>
+</head>
+<body onload="onLoad()">
+<table></table>
+<style></style>
+<spacer contenteditable>
+<p></p>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1402469.html b/editor/libeditor/crashtests/1402469.html
new file mode 100644
index 0000000000..06583acb8b
--- /dev/null
+++ b/editor/libeditor/crashtests/1402469.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+<script>
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node at end of the <body>.
+  getSelection().collapse(
+    document.body.lastChild,
+    document.body.lastChild.length
+  );
+  document.execCommand("insertUnorderedList");
+}
+</script>
+</head>
+<body onload="onLoad()">
+<table>
+  <th contenteditable>
+    <ol contenteditable>
+  </th>
+</table>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1402526.html b/editor/libeditor/crashtests/1402526.html
new file mode 100644
index 0000000000..fd75a30eca
--- /dev/null
+++ b/editor/libeditor/crashtests/1402526.html
@@ -0,0 +1,24 @@
+<script>
+function onLoad() {
+  const shadow = document.querySelector("shadow");
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // <shadow> which is the deepest last child of the <body>.
+  getSelection().collapse(shadow, shadow.childNodes.length);
+  try {
+    document.querySelector("dd[contenteditable]").addEventListener(
+      "DOMNodeInserted",
+      () => {
+        try {
+          shadow.replaceWith("1");
+        } catch(e) {}
+      }
+    );
+  } catch(e) {}
+  try {
+    document.execCommand("justifyFull");
+  } catch(e) {}
+}
+</script>
+<body onload="onLoad();">
+<dd contenteditable>
+<shadow></body>
diff --git a/editor/libeditor/crashtests/1402904.html b/editor/libeditor/crashtests/1402904.html
new file mode 100644
index 0000000000..544d01208a
--- /dev/null
+++ b/editor/libeditor/crashtests/1402904.html
@@ -0,0 +1,38 @@
+<script>
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // parent of <embed> (<embed> is not a container, therefore, its parent is the
+  // deepest last child container element of the <body>).
+  getSelection().collapse(
+    document.querySelector("embed").parentElement,
+    document.querySelector("embed").parentElement.childNodes.length
+  ); // Point the <embed>
+  const option = document.querySelector("option");
+  option.addEventListener("click", () => {
+    document.execCommand("forwardDelete");
+  });
+  const li2 = document.getElementById("li2");
+  li2.addEventListener("DOMNodeInserted", () => {
+    option.click();
+  });
+  const select = document.querySelector("select");
+  select.parentElement.setAttribute("onpageshow", "onPageShow()");
+}
+
+function onPageShow() {
+  const li1 = document.getElementById("li1");
+  li1.addEventListener("DOMSubtreeModified", () => {
+    document.execCommand("selectAll");
+    document.execCommand("indent");
+  });
+  li1.appendChild(document.createElement("legend"));
+}
+</script>
+<body onload="onLoad()">
+<select>
+<option></option>
+</select>
+<li id="li1"></li>
+<ul contenteditable="true">
+<li id="li2"></li>
+<embed>a;#2
diff --git a/editor/libeditor/crashtests/1405747.html b/editor/libeditor/crashtests/1405747.html
new file mode 100644
index 0000000000..dae3a130f0
--- /dev/null
+++ b/editor/libeditor/crashtests/1405747.html
@@ -0,0 +1,40 @@
+<script>
+let th;
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // <colgroup> which is the last child of the <body>.
+  getSelection().collapse(
+    document.querySelector("colgroup"),
+    document.querySelector("colgroup").childNodes.length
+  );
+  th = document.querySelector("th"); // Cache the target for removing the event handler.
+  try {
+    th.addEventListener("DOMSubtreeModified", onDOMSubtreeModified);
+  } catch(e) {}
+  try {
+    th.align = "";
+  } catch(e) {}
+}
+
+let count = 0;
+function onDOMSubtreeModified() {
+  if (count++ == 1) {
+    // If we didn't stop testing this, this event handler would be called too
+    // many times.  It's enough to run twice to reproduce the bug report.
+    th.removeEventListener("DOMSubtreeModified", onDOMSubtreeModified);
+  }
+  try {
+    document.execCommand("selectAll");
+  } catch(e) {}
+  try {
+    document.execCommand("justifyCenter");
+  } catch(e) {}
+  try {
+    document.execCommand("forwardDelete");
+  } catch(e) {}
+}
+</script>
+<body onload="onLoad()">
+<table contenteditable>
+<th></th>
+<colgroup></body>
diff --git a/editor/libeditor/crashtests/1405897.html b/editor/libeditor/crashtests/1405897.html
new file mode 100644
index 0000000000..60118628b5
--- /dev/null
+++ b/editor/libeditor/crashtests/1405897.html
@@ -0,0 +1,23 @@
+<style>
+* { position: absolute; }
+</style>
+<script>
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node in the <iframe> which is the last child of the <body>.  Note that
+  // <iframe> is treated as a container in HTMLEditor.
+  const iframe = document.querySelector("iframe");
+  getSelection().collapse(iframe.firstChild, iframe.firstChild.length);
+  document.querySelector("del").addEventListener("DOMSubtreeModified", () => {
+    document.execCommand("italic");
+    document.execCommand("selectAll");
+  });
+  const anchor = document.querySelector("a[contenteditable]");
+  anchor.replaceChild(iframe, anchor.childNodes[0]);
+}
+</script>
+<body onload="onLoad()">
+<a contenteditable>
+<del>
+<iframe>
+</body>
\ No newline at end of file
diff --git a/editor/libeditor/crashtests/1408170.html b/editor/libeditor/crashtests/1408170.html
new file mode 100644
index 0000000000..66119e9da3
--- /dev/null
+++ b/editor/libeditor/crashtests/1408170.html
@@ -0,0 +1,40 @@
+<script>
+function onLoad() {
+  try {
+    document.execCommand("insertUnorderedList");
+  } catch(e) {}
+  try {
+    document.execCommand("delete");
+  } catch(e) {}
+}
+
+function onToggle1() {
+  try {
+    getSelection().collapse(
+      document.querySelector("font"),
+      1
+    );
+  } catch(e) {}
+}
+
+function onToggle2() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node in the <summary> which is the last child of the <body>.
+  const summary = document.querySelector("summary");
+  getSelection().collapse(summary.firstChild, summary.firstChild.length);
+  try {
+    document.querySelector("label").appendChild(
+      document.querySelector("font")
+    );
+  } catch(e) {}
+}
+</script>
+<body onload="onLoad()">
+<label contenteditable>
+<details ontoggle="onToggle2()" open>
+</details>
+</label>
+<details ontoggle="onToggle1()" open>
+<font dir="rtl">
+<summary>
+</details></font></summary></body>
diff --git a/editor/libeditor/crashtests/1414581.html b/editor/libeditor/crashtests/1414581.html
new file mode 100644
index 0000000000..17cdc2f8c8
--- /dev/null
+++ b/editor/libeditor/crashtests/1414581.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function jsfuzzer() {
+  document.execCommand("outdent", false);
+}
+function eventhandler2() {
+  document.execCommand("styleWithCSS", false, true);
+}
+function eventhandler3() {
+  document.execCommand("delete", false);
+  var element1 = document.getElementById("element1");
+  document.getSelection().setPosition(element1, 0);
+  var element1 = document.getElementById("element2");
+  element2.ownerDocument.execCommand("insertOrderedList", false);
+  var element1 = document.getElementById("element3");
+  element3.addEventListener("DOMSubtreeModified", eventhandler3);
+  document.activeElement.setAttribute("contenteditable", "true");
+}
+</script>
+</head>
+<body onload=jsfuzzer()>
+<i id="element1">
+<audio i src="x"></audio>
+<da id="element2">
+<br id="element3" style="">
+<svg onload="eventhandler3()">
+<animate onbegin="eventhandler2()">
+<body>
+</html>
diff --git a/editor/libeditor/crashtests/1415231.html b/editor/libeditor/crashtests/1415231.html
new file mode 100644
index 0000000000..d8702e4542
--- /dev/null
+++ b/editor/libeditor/crashtests/1415231.html
@@ -0,0 +1,26 @@
+<script>
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node in the <option> which is in the last child of the <body>.
+  const option = document.querySelector("option");
+  getSelection().collapse(option.firstChild, option.firstChild.length);
+  document.querySelector("ins").addEventListener(
+    "DOMNodeRemoved",
+    onDOMNodeRemoved
+  );
+  getSelection().setPosition(
+    document.querySelector("shadow")
+  );
+  document.execCommand("insertText", false, "1");
+}
+function onDOMNodeRemoved() {
+  document.execCommand("insertHorizontalRule");
+  document.execCommand("justifyCenter");
+}
+</script>
+<body onload="onLoad()">
+<li contenteditable>
+<shadow>
+<ins>
+<option>
+</li></shadow></ins></option></body>
diff --git a/editor/libeditor/crashtests/1423767.html b/editor/libeditor/crashtests/1423767.html
new file mode 100644
index 0000000000..777cf58036
--- /dev/null
+++ b/editor/libeditor/crashtests/1423767.html
@@ -0,0 +1,17 @@
+<script>
+function onLoad() {
+  const label = document.querySelector("label");
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // <label> which is the last child of the <body>, i.e., at the comment node.
+  getSelection().collapse(label, label.childNodes.length);
+  label.addEventListener("DOMNodeRemoved", () => {
+    document.querySelector("a").innerText = "";
+  });
+  document.execCommand("indent");
+}
+</script>
+<body onload="onLoad()">
+<li contenteditable>
+<a>
+<label></br>
+<!---
diff --git a/editor/libeditor/crashtests/1423776.html b/editor/libeditor/crashtests/1423776.html
new file mode 100644
index 0000000000..4790a79f31
--- /dev/null
+++ b/editor/libeditor/crashtests/1423776.html
@@ -0,0 +1,25 @@
+<script>
+function onLoad() {
+  const svg = document.querySelector("svg");
+  const feConvolveMatrix = document.querySelectorAll("feConvolveMatrix");
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node in the last <svg> which is the deepest last child of the <body>
+  // (i.e., at end of the text node after the last <feConvolveMatrix>).
+  getSelection().collapse(svg.lastChild, svg.lastChild.length);
+  feConvolveMatrix[0].addEventListener("DOMNodeInserted", () => {
+    svg.appendChild(feConvolveMatrix[1]);
+    document.execCommand("insertOrderedList", false);
+  });
+  feConvolveMatrix[0].insertAdjacentHTML(
+    "afterBegin",
+    document.querySelector("table").outerHTML
+  );
+}
+</script>
+<body onload="onLoad()">
+<table></table>
+<b contenteditable>
+<svg>
+<feConvolveMatrix/>
+<feConvolveMatrix/>
+</svg></body>
diff --git a/editor/libeditor/crashtests/1424450.html b/editor/libeditor/crashtests/1424450.html
new file mode 100644
index 0000000000..bd0fd98a42
--- /dev/null
+++ b/editor/libeditor/crashtests/1424450.html
@@ -0,0 +1,51 @@
+<script>
+function onLoad() {
+  const feComponentTransfer = document.querySelector("feComponentTransfer");
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node in the <feComponentTransfer> which is the deepest last child of
+  // the <body>.
+  getSelection().collapse(
+    feComponentTransfer.firstChild,
+    feComponentTransfer.firstChild.length
+  );
+  getSelection().setPosition(
+    document.querySelector("pre[contenteditable]"),
+    1
+  );
+  getSelection().setBaseAndExtent(
+    document.querySelector("fieldset"),
+    0,
+    document.querySelector("use"),
+    0
+  );
+  feComponentTransfer.before(
+    document.querySelector("font-face-uri").previousElementSibling
+  );
+
+  document.execCommand("removeFormat");
+  document.execCommand("hiliteColor", false, "-moz-buttondefault");
+  document.execCommand("insertText", false, "");
+}
+function onBegin() {
+  document.querySelector("desc").appendChild(
+    document.querySelector("fieldset")
+  );
+  document.querySelector("span").appendChild(
+    document.querySelector("a[hidden][contenteditable]")
+  );
+}
+</script>
+<body onload="onLoad()">
+<span>
+<pre contenteditable>
+<fieldset></fieldset>
+<iframe srcdoc="H"></iframe>
+<a hidden contenteditable>
+<svg>
+<set onbegin="onBegin()"/>
+<use>
+<desc></desc>
+</use>
+<font-face-uri/>
+<feComponentTransfer>
+</feComponentTransfer></svg></a></pre></body>
diff --git a/editor/libeditor/crashtests/1425091.html b/editor/libeditor/crashtests/1425091.html
new file mode 100644
index 0000000000..be8f051931
--- /dev/null
+++ b/editor/libeditor/crashtests/1425091.html
@@ -0,0 +1,25 @@
+<script>
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node at end of the <body>, i.e., end of the text node after the
+  // <meter>.
+  getSelection().collapse(
+    document.body.lastChild,
+    document.body.lastChild.length
+  );
+  document.scrollingElement.addEventListener("DOMNodeInserted", () => {
+    document.execCommand("selectAll");
+    document.execCommand("insertOrderedList");
+  });
+  document.querySelector("style").appendChild(
+    document.createElement("e")
+  );
+}
+</script>
+<body onload="onLoad()">
+<meter contenteditable>
+<dialog>
+<style></style>
+</dialog>
+</meter>
+</body>
diff --git a/editor/libeditor/crashtests/1426709.html b/editor/libeditor/crashtests/1426709.html
new file mode 100644
index 0000000000..0026176e98
--- /dev/null
+++ b/editor/libeditor/crashtests/1426709.html
@@ -0,0 +1,27 @@
+<script>
+function onLoad() {
+  const pre = document.querySelector("pre[contenteditable]");
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node at end of the <pre> which is the deepest last child  of the
+  // <body>, i.e., end of the text node after the <input>.
+  getSelection().collapse(pre.lastChild, pre.lastChild.length);
+  document.querySelector("li").setAttribute("contenteditable", "true");
+  pre.addEventListener("DOMNodeRemoved", onDOMNodeRemoved);
+  pre.appendChild(
+    document.querySelector("input")
+  );
+}
+function onDOMNodeRemoved() {
+  document.body.appendChild(
+    document.querySelector("pre[contenteditable]")
+  );
+  document.execCommand("justifyFull");
+  document.execCommand("delete");
+}
+</script>
+<body onload="onLoad()">
+<li>
+A
+<pre contenteditable>
+<input autofocus>
+</pre></li></body>
diff --git a/editor/libeditor/crashtests/1429523.html b/editor/libeditor/crashtests/1429523.html
new file mode 100644
index 0000000000..67b227d20b
--- /dev/null
+++ b/editor/libeditor/crashtests/1429523.html
@@ -0,0 +1,18 @@
+<html class="reftest-wait">
+  <head>
+    <script>
+      document.designMode = "on";
+      Promise.all([
+        new Promise(resolve => addEventListener("load", resolve)),
+        new Promise(resolve => addEventListener("focus", resolve)),
+      ]).then(() => {
+        document.body.firstChild.data = "";
+        document.documentElement.removeAttribute("class");
+      });
+      blur();
+      focus();
+      getSelection().collapse(document.body, 0);
+    </script>
+  </head>
+  <body><!-- comment --></body>
+</html>
diff --git a/editor/libeditor/crashtests/1429523.xhtml b/editor/libeditor/crashtests/1429523.xhtml
new file mode 100644
index 0000000000..da2fe16b30
--- /dev/null
+++ b/editor/libeditor/crashtests/1429523.xhtml
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+  <head>
+    <script>
+      document.designMode = "on";
+      Promise.all([
+        new Promise(resolve => addEventListener("load", resolve)),
+        new Promise(resolve => addEventListener("focus", resolve)),
+      ]).then(() => {
+        document.body.firstChild.data = "";
+        document.documentElement.removeAttribute("class");
+      });
+      blur();
+      focus();
+      getSelection().collapse(document.body, 0);
+    </script>
+  </head>
+  <body><![CDATA[ CDATA ]]></body>
+</html>
diff --git a/editor/libeditor/crashtests/1441619.html b/editor/libeditor/crashtests/1441619.html
new file mode 100644
index 0000000000..08343feeed
--- /dev/null
+++ b/editor/libeditor/crashtests/1441619.html
@@ -0,0 +1,12 @@
+<html>
+  <head>
+    <script>
+      try { o1 = window.getSelection() } catch (e) {}
+      try { o2 = document.createRange() } catch (e) {}
+      try { document.head.replaceWith('', document.documentElement) } catch (e) {}
+      try { o1.addRange(o2) } catch (e) {}
+      try { document.designMode = 'on' } catch (e) {}
+      try { o1.focusNode.execCommand('justifyleft', false, null) } catch (e) {}
+    </script>
+  </head>
+</html>
diff --git a/editor/libeditor/crashtests/1443664.html b/editor/libeditor/crashtests/1443664.html
new file mode 100644
index 0000000000..b197d3cd49
--- /dev/null
+++ b/editor/libeditor/crashtests/1443664.html
@@ -0,0 +1,15 @@
+<style>
+input:focus { counter-increment: c; }
+</style>
+<script>
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node at end of the <body>, i.e., end of the text node after the
+  // <input contenteditable>.
+  getSelection().collapse(document.body, document.body.childNodes.length);
+  document.querySelector("input[type=number][contenteditable]").select();
+}
+</script>
+<body onload="onLoad()">
+<input type="number" contenteditable>
+</body>
diff --git a/editor/libeditor/crashtests/1444630.html b/editor/libeditor/crashtests/1444630.html
new file mode 100644
index 0000000000..3bdc490b36
--- /dev/null
+++ b/editor/libeditor/crashtests/1444630.html
@@ -0,0 +1,29 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+function load()
+{
+  let textarea = document.getElementById("editor");
+  textarea.focus();
+
+  const { maybeOnSpellCheck } = SpecialPowers.ChromeUtils.importESModule(
+    "resource://reftest/AsyncSpellCheckTestHelper.sys.mjs"
+  );
+  maybeOnSpellCheck(textarea, () => {
+    let isc = SpecialPowers.wrap(textarea).editor.getInlineSpellChecker(false);
+    let sc = isc.spellChecker;
+
+    textarea.setAttribute("lang", "en-US");
+    sc.UpdateCurrentDictionary(() => {
+      document.documentElement.classList.remove("reftest-wait");
+    });
+    sc.UninitSpellChecker();
+  });
+}
+</script>
+</head>
+<body onload="load()">
+<textarea id="editor" spellchecker="true">ABC</textarea>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1446451.html b/editor/libeditor/crashtests/1446451.html
new file mode 100644
index 0000000000..56c887dc3b
--- /dev/null
+++ b/editor/libeditor/crashtests/1446451.html
@@ -0,0 +1,13 @@
+<script>
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node in the <dialog> which is the deepest last child of the <body>.
+  const dialog = document.querySelector("dialog");
+  getSelection().collapse(dialog.lastChild, dialog.lastChild.length);
+  document.execCommand("insertImage", false, "o")
+}
+</script>
+<body onload="onLoad()">
+<meter contenteditable>
+<dialog>
+</dialog></meter></body>
diff --git a/editor/libeditor/crashtests/1464251.html b/editor/libeditor/crashtests/1464251.html
new file mode 100644
index 0000000000..afe7e87561
--- /dev/null
+++ b/editor/libeditor/crashtests/1464251.html
@@ -0,0 +1,25 @@
+<script>
+var count = 0;
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node in the <s> which is the deepest last child (and a container) of
+  // the <body> (i.e., end of the the text node after the last comment node).
+  const s = document.querySelector("s");
+  getSelection().collapse(s.lastChild, s.lastChild.length);
+  document.execCommand("delete");
+}
+
+function onInputOrDOMNodeInserted() {
+  if (++count >= 3) {
+    return;
+  }
+  addEventListener("DOMNodeInserted", onInputOrDOMNodeInserted);
+  document.execCommand("removeFormat");
+  document.execCommand("insertText", false, "1");
+}
+</script>
+<body onload="onLoad()">
+<ol oninput="onInputOrDOMNodeInserted()" contenteditable>
+<!-- x -->
+<s>
+<!-- x -->
diff --git a/editor/libeditor/crashtests/1470926.html b/editor/libeditor/crashtests/1470926.html
new file mode 100644
index 0000000000..9c39710a97
--- /dev/null
+++ b/editor/libeditor/crashtests/1470926.html
@@ -0,0 +1,9 @@
+<script>
+function go() {
+  a.select();
+  a.setAttribute("hidden", "");
+  a.setRangeText("f");
+}
+</script>
+<body onload=go()>
+<textarea id="a">-</textarea>
diff --git a/editor/libeditor/crashtests/1474978.html b/editor/libeditor/crashtests/1474978.html
new file mode 100644
index 0000000000..d7eb01e03b
--- /dev/null
+++ b/editor/libeditor/crashtests/1474978.html
@@ -0,0 +1,21 @@
+<script>
+function onLoad() {
+  const dd = document.querySelector("dd[contenteditable]");
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node at end of the <dd contenteditable> which is the deepest last
+  // child of the <body> (end of the text node after the <template>).
+  getSelection().collapse(dd.lastChild, dd.lastChild.length);
+  getSelection().setPosition(
+    document.querySelector("template")
+  );
+  dd.addEventListener("DOMNodeInserted", () => {
+    document.execCommand("selectAll");
+    document.execCommand("insertText", false, "");
+  });
+  document.execCommand("insertImage", false, "#");
+}
+</script>
+<body onload="onLoad()">
+<dd contenteditable>
+<template></template>
+</dd></body>
diff --git a/editor/libeditor/crashtests/1517028.html b/editor/libeditor/crashtests/1517028.html
new file mode 100644
index 0000000000..cbc3b71c0a
--- /dev/null
+++ b/editor/libeditor/crashtests/1517028.html
@@ -0,0 +1,23 @@
+<!-- COMMENT -->
+abc
+<head>
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // <em> which is the deepest last child of the <body> (at the comment node).
+  getSelection().collapse(
+    document.querySelector("em[contenteditable]"),
+    document.querySelector("em[contenteditable]").childNodes.length
+  );
+  document.execCommand("justifyLeft");
+  document.designMode = 'on';
+  document.execCommand("insertParagraph");
+});
+</script>
+</head>
+<h4>
+<em contenteditable>
+<big>
+<button autofocus formnovalidate formtarget="">
+</button>
+<!-- COMMENT --></big></em></h4></body>
diff --git a/editor/libeditor/crashtests/1525481.html b/editor/libeditor/crashtests/1525481.html
new file mode 100644
index 0000000000..d96e1c2d0d
--- /dev/null
+++ b/editor/libeditor/crashtests/1525481.html
@@ -0,0 +1,23 @@
+<script>
+function onLoad() {
+  const button = document.querySelector("button");
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // <button> which is the deepest last child of the <body>.
+  getSelection().collapse(button, button.childNodes.length);
+  document.execCommand("styleWithCSS", false, true);
+  document.execCommand("delete");
+  document.querySelector("ul[contenteditable]")
+    .addEventListener("DOMNodeRemoved", () => {
+      const range = document.createRange();
+      range.setEndAfter(button);
+      getSelection().addRange(range);
+      getSelection().deleteFromDocument();
+    });
+  document.execCommand("outdent");
+}
+</script>
+<body onload="onLoad()">
+<ul contenteditable style="margin: -1px 0px 1px 6px">
+<dd></dd>
+<dd>
+<button></button>></dd></ul></body>
diff --git a/editor/libeditor/crashtests/1533913.html b/editor/libeditor/crashtests/1533913.html
new file mode 100644
index 0000000000..3009bbb660
--- /dev/null
+++ b/editor/libeditor/crashtests/1533913.html
@@ -0,0 +1,19 @@
+<script>
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node which is the last child of the <dd contenteditable> which is the
+  // last child of the <body>.
+  const dd = document.querySelector("dd[contenteditable]");
+  getSelection().collapse(dd.lastChild, dd.lastChild.length);
+  document.execCommand("justifyFull");
+  document.execCommand("selectAll");
+  window.top.addEventListener("DOMNodeRemoved", () => {
+    document.execCommand("insertHTML", false, undefined)
+  });
+  document.execCommand("heading", false, "H1")
+}
+</script>
+<body onload="onLoad()">
+<dd contenteditable>A
+<!-- A -->
+</dd></body>
diff --git a/editor/libeditor/crashtests/1534394.html b/editor/libeditor/crashtests/1534394.html
new file mode 100644
index 0000000000..c254aa5f52
--- /dev/null
+++ b/editor/libeditor/crashtests/1534394.html
@@ -0,0 +1,29 @@
+<html>
+<head>
+    <script>
+
+      function start () {
+        const sel = document.getSelection()
+        const range_1 = new Range()
+        const noscript = document.getElementById('id_24')
+        const map = document.getElementById('id_26')
+        sel.selectAllChildren(noscript)
+        const range_2 = range_1.cloneRange()
+        range_2.selectNode(map)
+        const frag = range_2.extractContents()
+        range_2.insertNode(noscript)
+        document.documentElement.contentEditable = true
+        document.execCommand('removeFormat', false,)
+        noscript.contentEditable = false
+        document.execCommand('insertText', false, '�\n')
+      }
+
+      window.addEventListener('load', start)
+    </script>
+</head>
+<body>
+<big class="">
+    <map class="" id="id_26">
+        <noscript class="" id="id_24">
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1547897.html b/editor/libeditor/crashtests/1547897.html
new file mode 100644
index 0000000000..9543048e6c
--- /dev/null
+++ b/editor/libeditor/crashtests/1547897.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<script>
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // last text node of the <body> (end of the text node after the <p hidden>).
+  getSelection().collapse(
+    document.body.lastChild,
+    document.body.lastChild.length
+  );
+  getSelection().setPosition(
+    document.querySelector("hr"),
+    0
+  );
+  document.execCommand("delete");
+}
+</script>
+<body onload="onLoad()">
+<p hidden>
+    <canvas contenteditable>
+        <hr contenteditable>
+        3uW4*</hr></canvas>
+</p>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1547898.html b/editor/libeditor/crashtests/1547898.html
new file mode 100644
index 0000000000..696e429e0b
--- /dev/null
+++ b/editor/libeditor/crashtests/1547898.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+    <script>
+      function jsfuzzer () {
+        window.find('1')
+        const selection = window.getSelection()
+        selection.extend(document.getElementById('list_item'))
+        document.getElementById('list_item').contentEditable = 'true'
+        document.execCommand('indent', false)
+      }
+    </script>
+</head>
+<body onload=jsfuzzer()>
+<li id="list_item">16</li>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1556799.html b/editor/libeditor/crashtests/1556799.html
new file mode 100644
index 0000000000..7c213b1f27
--- /dev/null
+++ b/editor/libeditor/crashtests/1556799.html
@@ -0,0 +1,18 @@
+<script>
+function onError() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node in the <dl> which is the last deepest child of the <body>.
+  const dl =  document.querySelector("dl");
+  getSelection().collapse(dl.lastChild, dl.lastChild.length);
+  getSelection().selectAllChildren(
+    document.querySelector("img")
+  );
+  document.execCommand("insertUnorderedList");
+  document.execCommand("enableObjectResizing");
+}
+</script>
+<dd contenteditable="true">
+<audio src="data:text/html,foo" onerror="onError()">
+<img></img>
+<dl>
+</dl></audio><dd></body>
diff --git a/editor/libeditor/crashtests/1574544.html b/editor/libeditor/crashtests/1574544.html
new file mode 100644
index 0000000000..26b2fee5ff
--- /dev/null
+++ b/editor/libeditor/crashtests/1574544.html
@@ -0,0 +1,17 @@
+<style>
+* { display: table-caption }
+body { display: contents }
+</style>
+<script>
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node in the <th> which is the deepest last child of the <body>.
+  const th =  document.querySelector("th");
+  getSelection().collapse(th.lastChild, th.lastChild.length);
+  document.execCommand("enableInlineTableEditing");
+}
+</script>
+<body onload="onLoad()">
+<table contenteditable>
+<th>
+</th></table></body>
diff --git a/editor/libeditor/crashtests/1578916.html b/editor/libeditor/crashtests/1578916.html
new file mode 100644
index 0000000000..f1d79be804
--- /dev/null
+++ b/editor/libeditor/crashtests/1578916.html
@@ -0,0 +1,28 @@
+<script>
+function onLoad() {
+  const data = document.querySelector("data");
+  const source = document.querySelector("source");
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // <data> which is the deepest last child (and a container) of the <body>.
+  getSelection().collapse(data, data.childNodes.length);
+  source.appendChild(
+    document.body.firstChild  // The invisible text node
+  );
+  getSelection().setBaseAndExtent(
+    data.appendChild(source),
+    0,
+    source,
+    1
+  );
+  document.querySelector("audio")
+    .addEventListener("DOMCharacterDataModified", () => {
+      getSelection().removeAllRanges()
+    });
+  document.execCommand("delete");
+}
+</script>
+<body onload="onLoad()">
+<audio>
+<li contenteditable>
+<data>
+<source>
diff --git a/editor/libeditor/crashtests/1579934.html b/editor/libeditor/crashtests/1579934.html
new file mode 100644
index 0000000000..55be305e2f
--- /dev/null
+++ b/editor/libeditor/crashtests/1579934.html
@@ -0,0 +1,39 @@
+<html><script>
+window["_gaUserPrefs"] = { ioo : function() { return true; } }
+</script><head>
+<meta charset="windows-1252"><script>
+function onLoad() {
+  const form = document.querySelector("form");
+  form.addEventListener("DOMCharacterDataModified", () => {
+    document.documentElement.appendChild(form);
+  });
+  document.execCommand("delete");
+}
+
+function onToggle() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node node in the <button> which is the deepest last child of the
+  // <body>.
+  const button = document.querySelector("button");
+  getSelection().collapse(button.lastChild, button.lastChild.length);
+  document.querySelector("form").reset();
+}
+</script>
+</head><body onload="onLoad()">
+<details ontoggle="onToggle()" open>
+<dt contenteditable>
+</dt>
+</details><aside style="
+  position: fixed;
+  top: 0px;
+  right: 0px;
+  font-family: &quot;Lucida Console&quot;, monospace;
+  background-color: rgb(242, 230, 217);
+  padding: 3px;
+  z-index: 10000;
+  text-align: center;
+  max-width: 120px;
+  opacity: 0;
+  transition: opacity 0.5s linear 0s;">1194 x 73</aside></body><form id="b"><keygen>
+<button autofocus>
+</button></form></html>
diff --git a/editor/libeditor/crashtests/1581246.html b/editor/libeditor/crashtests/1581246.html
new file mode 100644
index 0000000000..e9c472c7d9
--- /dev/null
+++ b/editor/libeditor/crashtests/1581246.html
@@ -0,0 +1,21 @@
+<script>
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node in the <textarea> which is the last child of the <body>.
+  // However, it may be omitted by the parser.  Therefore, this test tries to
+  // check the text node, but if it does not exist, uses the <textarea>.
+  const textarea = document.querySelector("textarea");
+  const textareaOrTextNode = textarea.lastChild ? textarea.lastChild : textarea;
+  getSelection().collapse(textareaOrTextNode, textareaOrTextNode.length);
+  document.querySelector("script").appendChild(
+    document.querySelector("li[contenteditable=false]")
+  );
+  document.execCommand("indent");
+  document.execCommand("delete");
+}
+</script>
+<body onload="onLoad()">
+<ul contenteditable>
+<li contenteditable="false">
+<textarea autofocus>
+</textarea>></li></ul></body>
diff --git a/editor/libeditor/crashtests/1596516.html b/editor/libeditor/crashtests/1596516.html
new file mode 100644
index 0000000000..37b9c5889c
--- /dev/null
+++ b/editor/libeditor/crashtests/1596516.html
@@ -0,0 +1,18 @@
+<html>
+<head>
+    <script>
+      function start () {
+        const italic = document.createElementNS('http://www.w3.org/1999/xhtml', 'i')
+        italic.dir = ''
+        document.documentElement.contentEditable = 'true'
+        const selection = document.getSelection()
+        const range = selection.getRangeAt(0)
+        const attribute = italic.attributes.getNamedItem('dir')
+        range.setEnd(attribute, (2361162229 % attribute.childNodes))
+        document.queryCommandState('heading')
+      }
+
+      document.addEventListener('DOMContentLoaded', start)
+    </script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1605741.html b/editor/libeditor/crashtests/1605741.html
new file mode 100644
index 0000000000..7868adcf96
--- /dev/null
+++ b/editor/libeditor/crashtests/1605741.html
@@ -0,0 +1,14 @@
+<script>
+addEventListener("load", () => {
+  const editingHost = document.querySelector("div[contenteditable]");
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node in the <div contenteditable> which is the last child of the
+  // <body>.
+  getSelection().collapse(editingHost.lastChild, editingHost.lastChild.length);
+  editingHost.addEventListener("DOMNodeRemoved", () => {
+    getSelection().collapse(null);
+  });
+  document.execCommand("delete");
+});
+</script>
+<div contenteditable>x</link></body>
diff --git a/editor/libeditor/crashtests/1613521.html b/editor/libeditor/crashtests/1613521.html
new file mode 100644
index 0000000000..7d59667559
--- /dev/null
+++ b/editor/libeditor/crashtests/1613521.html
@@ -0,0 +1,16 @@
+<script>
+function go() {
+  window.find("1", true, false)
+  a.setAttribute("contenteditable", "true")
+  document.execCommand("forwardDelete", false)
+  document.execCommand("enableObjectResizing", false)
+}
+</script>
+<dl id="a">
+<table>
+<th>
+GjdR1W3
+<svg>
+<animateMotion onbegin="go()" />
+</tr>
+<details ontoggle="go()" open>
diff --git a/editor/libeditor/crashtests/1618906.html b/editor/libeditor/crashtests/1618906.html
new file mode 100644
index 0000000000..cdb278f018
--- /dev/null
+++ b/editor/libeditor/crashtests/1618906.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+    <script>
+      window.addEventListener('load', () => {
+        const range = new Range()
+        const fragment = range.cloneContents()
+        range.selectNodeContents(document)
+        document.designMode = 'on'
+        document.replaceChild(fragment, document.documentElement)
+        const selection = window.getSelection()
+        selection.addRange(range)
+        document.execCommand('indent', false, null)
+      })
+    </script>
+</head>
+</html>
+<!-- COMMENT -->
diff --git a/editor/libeditor/crashtests/1623166.html b/editor/libeditor/crashtests/1623166.html
new file mode 100644
index 0000000000..75bbb20872
--- /dev/null
+++ b/editor/libeditor/crashtests/1623166.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+  const code = document.querySelector("code[contenteditable=false]");
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // last text node in the <code> which is the last inline container of the
+  // <body>.
+  getSelection().collapse(code.lastChild, code.lastChild.length);
+  code.querySelector("br").contentEditable = true;
+  document.execCommand("indent");
+});
+</script>
+<body>
+<b contenteditable hidden>
+    <script></script>
+    <code contenteditable="false">
+        <br>
+</body>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1623913.html b/editor/libeditor/crashtests/1623913.html
new file mode 100644
index 0000000000..291bd65197
--- /dev/null
+++ b/editor/libeditor/crashtests/1623913.html
@@ -0,0 +1,30 @@
+<html>
+<head>
+    <script>
+      async function start () {
+        const element_0 = document.createElementNS('', 's')
+        const svg = document.getElementById('id_8')
+        const math = document.getElementById('id_20')
+        const selection = window.getSelection()
+        const range = new Range()
+        range.setStartAfter(math)
+        range.insertNode(svg)
+        range.selectNodeContents(element_0)
+        document.documentElement.contentEditable = true
+        range.setStart(svg, (2760506212 % svg.childNodes))
+        selection.addRange(range)
+        document.execCommand('insertOrderedList', false, null)
+        document.execCommand('insertParagraph', false, null)
+      }
+
+      document.addEventListener('DOMContentLoaded', start)
+    </script>
+</head>
+<body>
+<svg id='id_8'>
+    <metadata xml:space='preserve'>
+</svg>
+<math id='id_20'>
+</math>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1624005.html b/editor/libeditor/crashtests/1624005.html
new file mode 100644
index 0000000000..9d277db6ed
--- /dev/null
+++ b/editor/libeditor/crashtests/1624005.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+    <script>
+      window.addEventListener('load', () => {
+        const element = document.createElementNS('', 't')
+        document.designMode = 'on'
+        const range = new Range()
+        range.selectNodeContents(element)
+        range.surroundContents(document.documentElement)
+        document.execCommand('insertHorizontalRule', false, null)
+      })
+    </script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1624007.html b/editor/libeditor/crashtests/1624007.html
new file mode 100644
index 0000000000..06e35e1d50
--- /dev/null
+++ b/editor/libeditor/crashtests/1624007.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+    <script>
+      window.addEventListener('load', () => {
+        const element = document.createElement('t')
+        document.documentElement.appendChild(element)
+        document.documentElement.contentEditable = true
+        const selection = self.getSelection()
+        const range_1 = new Range()
+        range_1.setStart(element, (1715865858 % element.childNodes))
+        document.execCommand('enableObjectResizing', false, true)
+        const range_2 = new Range()
+        selection.addRange(range_2)
+        selection.addRange(range_1)
+        document.execCommand('bold', false, null)
+      })
+    </script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1624011.html b/editor/libeditor/crashtests/1624011.html
new file mode 100644
index 0000000000..98267f848d
--- /dev/null
+++ b/editor/libeditor/crashtests/1624011.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+    <script>
+      window.addEventListener('load', () => {
+        document.designMode = 'on'
+        const selection = document.getSelection()
+        selection.empty()
+        document.queryCommandIndeterm('justifyFull')
+      })
+    </script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1626002.html b/editor/libeditor/crashtests/1626002.html
new file mode 100644
index 0000000000..55099cb648
--- /dev/null
+++ b/editor/libeditor/crashtests/1626002.html
@@ -0,0 +1,27 @@
+<html>
+<head>
+<script>
+addEventListener("load", () => {
+  const anchor = document.createElement("a");
+  const b = document.createElement("b");
+  const c = document.createElement("c");
+  document.documentElement.appendChild(anchor);
+  anchor.appendChild(b);
+  b.setAttribute("contenteditable", "true");
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // <body> which must be empty because this test appends the new elements after
+  // the <body>.
+  const selection = self.getSelection();
+  selection.collapse(document.body, document.body.childNodes.length);
+  b.appendChild(c);
+  c.outerHTML = '<s contenteditable="false"><b contenteditable="true">';
+  selection.setBaseAndExtent(document, 0, document.documentElement, 0);
+  const range = selection.getRangeAt((260523900 % selection.rangeCount));
+  selection.selectAllChildren(b);
+  range.collapse(false);
+  range.setEndAfter(document.documentElement);
+  range.extractContents();
+});
+</script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1636541.html b/editor/libeditor/crashtests/1636541.html
new file mode 100644
index 0000000000..71a92817d8
--- /dev/null
+++ b/editor/libeditor/crashtests/1636541.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+    <script>
+      window.addEventListener('load', () => {
+        document.documentElement.contentEditable = true
+        document.execCommand('indent', false, null)
+        const selection = document.getSelection()
+        selection.collapse(document.documentElement, (3474956128 % document.documentElement.childNodes))
+        document.execCommand('indent', false, null)
+        document.execCommand('outdent', false, null)
+      })
+    </script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1644903.html b/editor/libeditor/crashtests/1644903.html
new file mode 100644
index 0000000000..175c6afda7
--- /dev/null
+++ b/editor/libeditor/crashtests/1644903.html
@@ -0,0 +1,19 @@
+<script>
+window.onload = () => {
+  document.execCommand("undo");
+}
+function onToggle() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node at end of the <details> (<p> is closed before the <details>).
+  const details = document.querySelector("details");
+  getSelection().collapse(details.lastChild, details.lastChild.length);
+  const link = document.querySelector("link");
+  document.execCommand("delete");
+  document.querySelector("iframe").contentDocument.adoptNode(link);
+}
+</script>
+<p contenteditable>
+<link item="">
+<details open ontoggle="onToggle()">
+<iframe></iframe>
+</details></body>
diff --git a/editor/libeditor/crashtests/1645983-1.html b/editor/libeditor/crashtests/1645983-1.html
new file mode 100644
index 0000000000..c1bb7219a5
--- /dev/null
+++ b/editor/libeditor/crashtests/1645983-1.html
@@ -0,0 +1,11 @@
+<div contenteditable>&nbsp;a</div>
+<script>
+// For emulating the traditional behavior, collapse Selection to end of the
+// text node in this <script>.
+const script = document.querySelector("script");
+getSelection().collapse(script.lastChild, script.lastChild.length);
+const editingHost = document.querySelector("div[contenteditable]");
+editingHost.insertBefore(document.createTextNode(""), editingHost.firstChild);
+getSelection().collapse(editingHost.firstChild.nextSibling, 2);
+document.execCommand("delete");
+</script></body>
diff --git a/editor/libeditor/crashtests/1645983-2.html b/editor/libeditor/crashtests/1645983-2.html
new file mode 100644
index 0000000000..132c1381f3
--- /dev/null
+++ b/editor/libeditor/crashtests/1645983-2.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<div contenteditable>abc<span></span><span></span></div>
+<script>
+// For emulating the traditional behavior, collapse Selection to end of the
+// text node after this <script>.
+getSelection().collapse(
+  document.body.lastChild,
+  document.body.lastChild.length
+);
+const editingHost = document.querySelector("div[contenteditable]");
+getSelection().collapse(editingHost, 3);
+document.execCommand("insertText", false, " ");
+</script>
+</body>
diff --git a/editor/libeditor/crashtests/1648564.html b/editor/libeditor/crashtests/1648564.html
new file mode 100644
index 0000000000..f82ec3d8e6
--- /dev/null
+++ b/editor/libeditor/crashtests/1648564.html
@@ -0,0 +1,29 @@
+<script>
+window.addEventListener('load', () => {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // <body> (at the comment node).
+  getSelection().collapse(document.body, document.body.childNodes.length);
+  const map = document.querySelector("map");
+  const anchor = document.querySelector("a");
+  map.replaceChild(
+    anchor,
+    map.childNodes[(2828994049 % map.childNodes.length)]
+  );
+  anchor.innerHTML = "<o>";
+  getSelection().setBaseAndExtent(
+    document,
+    (2019424593 % document.childNodes.length),
+    document.documentElement,
+    (3503355750 % document.documentElement.childNodes.length)
+  );
+  document.designMode = "on";
+  document.execCommand("forwardDelete");
+  document.execCommand("forwardDelete");
+});
+</script>
+<sub contenteditable>
+<map>
+<address></address>
+<a>
+</a>
+<!-- COMMENT --></body>
diff --git a/editor/libeditor/crashtests/1655508.html b/editor/libeditor/crashtests/1655508.html
new file mode 100644
index 0000000000..e30aba0ca0
--- /dev/null
+++ b/editor/libeditor/crashtests/1655508.html
@@ -0,0 +1,34 @@
+<html>
+<head>
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node at end of the <body> (end of the text node after the <h3>).
+  getSelection().collapse(
+    document.body.lastChild,
+    document.body.lastChild.length
+  );
+  const textarea = document.querySelector("textarea");
+  const abbr = document.querySelector("abbr");
+  let node;
+  document.addEventListener("DOMAttrModified", event => {
+    node = event.originalTarget.getRootNode({});
+    abbr.insertBefore(textarea, abbr.childNodes[0]);
+  }, false);
+  abbr.contentEditable = false;
+  node.normalize();
+  document.designMode = "on";
+  document.execCommand("insertParagraph");
+});
+</script>
+</head>
+<body>
+<dfn contenteditable>
+    <abbr></abbr>
+</dfn>
+<h3>
+    <textarea autofocus></textarea>
+    <script></script>
+</h3>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1655539.html b/editor/libeditor/crashtests/1655539.html
new file mode 100644
index 0000000000..094c7b2e30
--- /dev/null
+++ b/editor/libeditor/crashtests/1655539.html
@@ -0,0 +1,15 @@
+<script>
+  document.addEventListener('DOMContentLoaded', () => {
+    selection = document.getSelection()
+    element = document.createElementNS('', 'm')
+    document.documentElement.appendChild(element)
+    range = new Range()
+    range.setStartBefore(element)
+    selection.addRange(range)
+    document.documentElement.contentEditable = true
+    document.execCommand('forwardDelete', false, null)
+  })
+</script>
+<iframe class='\'>'>
+</iframe>
+<!-- COMMENT -->
\ No newline at end of file
diff --git a/editor/libeditor/crashtests/1655988.html b/editor/libeditor/crashtests/1655988.html
new file mode 100644
index 0000000000..666a5f8cb8
--- /dev/null
+++ b/editor/libeditor/crashtests/1655988.html
@@ -0,0 +1,29 @@
+<html>
+<head>
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node at end of the <body> (end of the text node after the
+  // <feDistantLight>).
+  getSelection().collapse(
+    document.body.lastChild,
+    document.body.lastChild.length
+  );
+  const feDistantLight = document.querySelector("feDistantLight");
+  const li = document.querySelector("li");
+  li.after('foo');
+  feDistantLight.addEventListener("DOMAttrModified", () => {
+    window.find("foo");
+    document.execCommand("insertImage", false, "#");
+  })
+  feDistantLight.setAttribute("i", "");
+});
+</script>
+</head>
+<body>
+<feDistantLight contenteditable>
+    <li>A</li>
+    <!-- COMMENT -->
+</feDistantLight>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1659717.html b/editor/libeditor/crashtests/1659717.html
new file mode 100644
index 0000000000..a3e9c59699
--- /dev/null
+++ b/editor/libeditor/crashtests/1659717.html
@@ -0,0 +1,14 @@
+<html><script type="text/javascript" id="__gaOptOutExtension">window["_gaUserPrefs"] = { ioo : function() { return true; } }</script><head>
+<meta http-equiv="content-type" content="text/html; charset=windows-1252">
+    <script>
+      document.addEventListener('DOMContentLoaded', async () => {
+        const selection = document.getSelection()
+        document.designMode = 'on'
+        selection.collapse(document, 0)
+        document.execCommand('forwardDelete', false, null)
+      })
+    </script>
+</head>
+<body>
+<aside style="position:fixed;top:0px;right:0px;font-family:&quot;Lucida Console&quot;,monospace;background-color:#f2e6d9;padding:3px;z-index:10000;text-align:center;max-width:120px;opacity:0;transition:opacity linear;"></aside></body></html>
+<!-- COMMENT -->
\ No newline at end of file
diff --git a/editor/libeditor/crashtests/1663725.html b/editor/libeditor/crashtests/1663725.html
new file mode 100644
index 0000000000..7f4ffd62eb
--- /dev/null
+++ b/editor/libeditor/crashtests/1663725.html
@@ -0,0 +1,18 @@
+<script>
+window.onload = () => {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // <body> (at the text node after the <input>).
+  getSelection().collapse(document.body, document.body.childNodes.length);
+  document.execCommand("insertHorizontalRule");
+  getSelection().collapse(
+    document.querySelector("b")
+  );
+  document.execCommand("forwardDelete");
+}
+function onFocusChangeOfInput() {
+  document.getSelection().setPosition(document.querySelector("pre"));
+}
+</script>
+<pre>
+<time contenteditable>a|</t>
+<input onfocus="onFocusChangeOfInput()" autofocus onblur="onFocusChangeOfInput()">
diff --git a/editor/libeditor/crashtests/1666556.html b/editor/libeditor/crashtests/1666556.html
new file mode 100644
index 0000000000..8c8c18574a
--- /dev/null
+++ b/editor/libeditor/crashtests/1666556.html
@@ -0,0 +1,28 @@
+<script>
+function onError() {
+  document.querySelector("details").appendChild(
+    document.querySelector("p")
+  );
+  document.execCommand("indent");
+}
+
+function onLoadOfStyle() {
+  document.execCommand("delete");
+  document.querySelector("details").contentEditable = "true";
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node at end of the <style> (end of the text node after the comment
+  // node).
+  const style = document.querySelector("style");
+  getSelection().collapse(style.lastChild, style.lastChild.length);
+  document.querySelector("input").select();
+}
+</script>
+<video focus="false">
+<source onerror="onError()">
+</video>
+<details open>
+<p>
+<input contenteditable="false">
+<style onload="onLoadOfStyle()">
+<!-- x -->
+</style></p></details></body>
diff --git a/editor/libeditor/crashtests/1677566.html b/editor/libeditor/crashtests/1677566.html
new file mode 100644
index 0000000000..1546bb4601
--- /dev/null
+++ b/editor/libeditor/crashtests/1677566.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+  const table = document.querySelector("table");
+  // For emulating traditional behavior, collapse Selection to end of the
+  // text node after the <p> (<table> does not close the <p>).
+  getSelection().collapse(
+    document.body.lastChild,
+    document.body.lastChild.length
+  );
+  const paragraph = document.querySelector("p");
+  document.documentElement.contentEditable = true;
+  getSelection().setBaseAndExtent(document, 0, document.documentElement, 1);
+  paragraph.contentEditable = false;
+  table.insertRow(0);
+  document.execCommand("forwardDelete");
+});
+</script>
+</head>
+<p>
+    <del>
+        <button contenteditable>
+        </button>
+        <table>
+        </table>
+    </del>
+</p>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1691051.html b/editor/libeditor/crashtests/1691051.html
new file mode 100644
index 0000000000..29aeae551c
--- /dev/null
+++ b/editor/libeditor/crashtests/1691051.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script>
+        window.addEventListener('load', () => {
+            document.documentElement.contentEditable = true
+            document.execCommand('selectAll', false, null)
+            document.addEventListener('DOMNodeRemoved', async (e) => {
+                e.currentTarget.writeln()
+            }, {})
+            document.execCommand('insertLineBreak', false, null)
+        })
+    </script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/1699866.html b/editor/libeditor/crashtests/1699866.html
new file mode 100644
index 0000000000..f8d700ec9c
--- /dev/null
+++ b/editor/libeditor/crashtests/1699866.html
@@ -0,0 +1,22 @@
+<script>
+window.onload = () => {
+  const font = document.querySelector("font");
+  // For emulating traditional behavior, collapse Selection to end of the
+  // text node in the <font>.
+  getSelection().collapse(font.lastChild, font.lastChild.length);
+  const meta = document.querySelector("meta");
+  meta.style.setProperty(
+    "text-decoration",
+    "overline underline line-through"
+  );
+  meta.appendChild(font);
+  document.execCommand("selectAll");
+  getSelection().extend(meta, 0);
+  document.execCommand("underline");
+}
+</script>
+<ins contenteditable>
+a
+<meta></meta>
+<font>
+</font></ins></body>
diff --git a/editor/libeditor/crashtests/1701348.html b/editor/libeditor/crashtests/1701348.html
new file mode 100644
index 0000000000..1e8c2fbaa7
--- /dev/null
+++ b/editor/libeditor/crashtests/1701348.html
@@ -0,0 +1,10 @@
+<style>
+.c { resize: both }
+</style>
+<script>
+window.onload = () => {
+  a.className = "a"
+  document.execCommand("delete", false)
+}
+</script>
+<input id="a" autofocus="autofocus" class="c">
diff --git a/editor/libeditor/crashtests/1707630.html b/editor/libeditor/crashtests/1707630.html
new file mode 100644
index 0000000000..e62df20b1b
--- /dev/null
+++ b/editor/libeditor/crashtests/1707630.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script>
+      window.addEventListener('load', () => {
+        document = document
+        document.documentElement = document.documentElement
+        document.addEventListener('DOMNodeInserted', (e) => {
+          e.currentTarget.removeChild(e.currentTarget.childNodes[(2731378636 % e.currentTarget.childNodes.length)])
+        }, {})
+        document.documentElement.contentEditable = true
+        document.execCommand('insertParagraph', false, null)
+      })
+    </script>
+</head>
+</html>
diff --git a/editor/libeditor/crashtests/336081-1.xhtml b/editor/libeditor/crashtests/336081-1.xhtml
new file mode 100644
index 0000000000..5a499d9f51
--- /dev/null
+++ b/editor/libeditor/crashtests/336081-1.xhtml
@@ -0,0 +1,52 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+<![CDATA[
+
+function foop(targetWindow)
+{
+  var targetDocument = targetWindow.document;
+
+  var r1 = targetDocument.createRange(); 
+  r1.setStart(targetDocument.getElementById("out1"), 0); 
+  r1.setEnd  (targetDocument.getElementById("out2"), 0); 
+  targetWindow.getSelection().addRange(r1);
+
+  var r2 = targetDocument.createRange(); 
+  r2.setStart(targetDocument.getElementById("in1"), 0); 
+  r2.setEnd  (targetDocument.getElementById("in2"), 0); 
+  targetWindow.getSelection().addRange(r2);
+    
+  targetDocument.execCommand('removeformat', false, null);
+  targetDocument.execCommand('outdent', false, null);
+}
+
+function init()
+{
+  setTimeout(function()
+  {
+    var fd = window.frames[0].document;
+    fd.body.appendChild(fd.importNode(document.getElementById('rootish'), true));
+    fd.designMode = 'on';
+    foop(window.frames[0]);
+    document.documentElement.removeAttribute("class");
+  }, 100); 
+}
+
+]]>
+</script>
+</head>
+
+<body onload="init()">
+
+<iframe srcdoc="<html></html>" style="width: 95%; height: 500px;"/>
+
+<div id="rootish">
+<div id="out1"/>
+<div id="in1"/>
+<div id="in2"/>
+<div id="out2"/>
+</div>
+
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/403965-1.xhtml b/editor/libeditor/crashtests/403965-1.xhtml
new file mode 100644
index 0000000000..02993914d9
--- /dev/null
+++ b/editor/libeditor/crashtests/403965-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<tbody contenteditable="true"/>
+<frameset/>
+<xul:box onbeforecopy="event.explicitOriginalTarget.parentNode.parentNode.removeChild(event.explicitOriginalTarget.parentNode)">
+<xul:box/>
+</xul:box>
+</html>
\ No newline at end of file
diff --git a/editor/libeditor/crashtests/428489-1.html b/editor/libeditor/crashtests/428489-1.html
new file mode 100644
index 0000000000..8eec1268b9
--- /dev/null
+++ b/editor/libeditor/crashtests/428489-1.html
@@ -0,0 +1,8 @@
+<html>
+<head>
+<title>Crash [@ nsHTMLEditor::GetPositionAndDimensions] when window gets removed during click on contenteditable absolute positioned element</title>
+</head>
+<body>
+<iframe id="content" src="data:text/html;charset=utf-8,%3Chtml%3E%3Chead%3E%0A%3Cscript%3E%0Awindow.addEventListener%28%27DOMAttrModified%27%2C%20function%28e%29%20%7Bdump%28%27DOMAttrModified\n%27%29%3Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%3B%7D%2C%20true%29%3B%0A%3C/script%3E%0A%3C/head%3E%0A%3Cbody%3E%0A%3Cdiv%20style%3D%22position%3A%20absolute%3B%22%20contenteditable%3D%22true%22%3EClicking%20on%20this%20should%20not%20crash%20Mozilla%0A%3C/body%3E%0A%3C/html%3E" style="width:1000px;height: 300px;"></iframe>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/429586-1.html b/editor/libeditor/crashtests/429586-1.html
new file mode 100644
index 0000000000..a32df3b721
--- /dev/null
+++ b/editor/libeditor/crashtests/429586-1.html
@@ -0,0 +1,8 @@
+<html>
+<head>
+<title>Bug 429586 - Crash [@ nsEditor::EndUpdateViewBatch] with pasting and domattrmodified removing iframe</title>
+</head>
+<body>
+<iframe id="content" src="data:text/html;charset=utf-8,%3Chtml%3E%0A%3Chead%3E%0A%3C/head%3E%0A%3Cbody%20contenteditable%3D%22true%22%3E%0A%0A%3Cscript%3E%0Afunction%20dokey%28%29%7B%0Adocument.body.focus%28%29%3B%0Adocument.execCommand%28%27insertParagraph%27%2C%20false%2C%20%27%27%29%3B%0A%7D%0AsetTimeout%28dokey%2C200%29%3B%0A%0Adocument.addEventListener%28%27DOMAttrModified%27%2C%20function%28%29%20%7Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%7D%2C%20true%29%3B%0A%3C/script%3E%0A%3C/body%3E%0A%3C/html%3E"></iframe>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/431086-1.xhtml b/editor/libeditor/crashtests/431086-1.xhtml
new file mode 100644
index 0000000000..c6c5d8d992
--- /dev/null
+++ b/editor/libeditor/crashtests/431086-1.xhtml
@@ -0,0 +1,22 @@
+<div xmlns="http://www.w3.org/1999/xhtml">
+
+<script type="text/javascript">
+
+function boom()
+{
+  var r = document.documentElement;
+  r.style.position = "absolute";
+  r.contentEditable = "true";
+  r.focus();
+  r.contentEditable = "false";
+  r.focus();
+  r.contentEditable = "true";
+  document.execCommand("subscript", false, null);
+  r.contentEditable = "false";
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+
+</div>
diff --git a/editor/libeditor/crashtests/475132-1.xhtml b/editor/libeditor/crashtests/475132-1.xhtml
new file mode 100644
index 0000000000..e721c55639
--- /dev/null
+++ b/editor/libeditor/crashtests/475132-1.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+function onLoad() {
+  document.querySelector("td").contentEditable = "true";
+  getSelection().collapse(
+    document.querySelector("td"),
+    document.querySelector("td").childNodes.length
+  );
+  document.querySelector("td").focus();
+  document.documentElement.contentEditable = "true";
+  document.documentElement.focus();
+  document.execCommand("indent");
+  document.execCommand("insertParagraph");
+}
+</script>
+</head>
+
+<body onload="onLoad();" contenteditable="false"><td></td></body>
+
+</html>
diff --git a/editor/libeditor/crashtests/503709-1.xhtml b/editor/libeditor/crashtests/503709-1.xhtml
new file mode 100644
index 0000000000..867bebf1a9
--- /dev/null
+++ b/editor/libeditor/crashtests/503709-1.xhtml
@@ -0,0 +1,11 @@
+<html contenteditable="true" xmlns="http://www.w3.org/1999/xhtml"><head><script>
+
+function boom()
+{
+  document.execCommand("selectAll", false, "");
+  try { document.execCommand("justifyfull", false, null); } catch(e) { }
+  try { document.execCommand("inserthorizontalrule", false, "false"); } catch(e) { }
+  document.execCommand("delete", false, null);
+}
+
+</script></head>x y z<body onload="boom();"><div/></body></html>
diff --git a/editor/libeditor/crashtests/513375-1.xhtml b/editor/libeditor/crashtests/513375-1.xhtml
new file mode 100644
index 0000000000..4db5a42159
--- /dev/null
+++ b/editor/libeditor/crashtests/513375-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head contenteditable="true">
+<script type="text/javascript">
+<![CDATA[
+function onLoad() {
+  getSelection().collapse(document.body, document.body.childNodes.length);
+  const r = document.createRange();
+  r.selectNode(document.body);
+  r.deleteContents();
+  try {
+    document.execCommand("selectAll");
+  } catch(e) {}
+}
+]]>
+</script>
+</head>
+
+<body onload="onLoad();" contenteditable="true"></body>
+</html>
diff --git a/editor/libeditor/crashtests/535632-1.xhtml b/editor/libeditor/crashtests/535632-1.xhtml
new file mode 100644
index 0000000000..92470b8258
--- /dev/null
+++ b/editor/libeditor/crashtests/535632-1.xhtml
@@ -0,0 +1 @@
+<body xmlns="http://www.w3.org/1999/xhtml" style="margin: 200px;" contenteditable="true" onload="document.execCommand('outdent', false, null);" />
\ No newline at end of file
diff --git a/editor/libeditor/crashtests/574558-1.xhtml b/editor/libeditor/crashtests/574558-1.xhtml
new file mode 100644
index 0000000000..4e61ad02e7
--- /dev/null
+++ b/editor/libeditor/crashtests/574558-1.xhtml
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><head><script>
+<![CDATA[
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // text node in the <textarea> which is the deepest last child of the <body>.
+  const textarea = document.querySelector("textarea");
+  getSelection().collapse(textarea.lastChild, textarea.lastChild.length);
+  document.execCommand("selectAll");
+  document.execCommand("selectAll");
+  document.execCommand("inserthtml", false, "<span><div>");
+  const span = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+  textarea.appendChild(span);
+}
+]]>
+</script></head><div contenteditable="true"></div><body onload="onLoad();"><textarea>f</textarea></body></html>
diff --git a/editor/libeditor/crashtests/580151-1.xhtml b/editor/libeditor/crashtests/580151-1.xhtml
new file mode 100644
index 0000000000..3799411117
--- /dev/null
+++ b/editor/libeditor/crashtests/580151-1.xhtml
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+var t;
+
+function boom()
+{
+  var b = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+  t = document.createElementNS("http://www.w3.org/1999/xhtml", "textarea");
+  b.appendChild(t);
+  document.removeChild(document.documentElement)
+  document.appendChild(b)
+  document.removeChild(document.documentElement)
+  var ns = document.createElementNS("http://www.w3.org/1999/xhtml", "script");
+  var nt = document.createTextNode("t.appendChild(document.createTextNode(' '));");
+  ns.appendChild(nt);
+  b.appendChild(ns);
+  document.appendChild(b);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/582138-1.xhtml b/editor/libeditor/crashtests/582138-1.xhtml
new file mode 100644
index 0000000000..afcec2eba1
--- /dev/null
+++ b/editor/libeditor/crashtests/582138-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><mtr xmlns="http://www.w3.org/1998/Math/MathML"><td id="cell" xmlns="http://www.w3.org/1999/xhtml"></td></mtr><script>
+function boom()
+{
+  document.getElementById("cell").contentEditable = true;
+  document.getElementById("cell").focus();
+  document.execCommand("inserthtml", false, "x");
+}
+
+window.addEventListener("load", boom, false);
+</script></html>
diff --git a/editor/libeditor/crashtests/633709.xhtml b/editor/libeditor/crashtests/633709.xhtml
new file mode 100644
index 0000000000..75ad518b8f
--- /dev/null
+++ b/editor/libeditor/crashtests/633709.xhtml
@@ -0,0 +1,68 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<body><div contenteditable="true"></div><div><input><div></div></input></div></body>
+
+<script>
+<![CDATA[
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // parent <div> of the <input>.  In XHTML document, the <input> may have the
+  // <div> child.  Therefore, the deepest last child container element of the
+  // <body> is the parent of the <input>.
+  getSelection().collapse(
+    document.querySelector("input").parentElement,
+    document.querySelector("input").parentElement.childNodes.length
+  );
+  document.querySelector("input").focus();
+
+  try {
+    document.execCommand("stylewithcss", false, "true");
+  } catch(e) {}
+  try {
+    document.execCommand("inserthtml", false, "<x>X</x>");
+  } catch(e) {}
+  try {
+    document.execCommand("underline");
+  } catch(e) {}
+  try {
+    document.execCommand("justifyfull");
+  } catch(e) {}
+  try {
+    document.execCommand("underline");
+  } catch(e) {}
+  try {
+    document.execCommand("insertParagraph");
+  } catch(e) {}
+  try {
+    document.execCommand("delete");
+  } catch(e) {}
+
+  try {
+    document.execCommand("stylewithcss", false, "false");
+  } catch(e) {}
+  try {
+    document.execCommand("inserthtml", false, "<x>X</x>");
+  } catch(e) {}
+  try {
+    document.execCommand("underline");
+  } catch(e) {}
+  try {
+    document.execCommand("justifyfull");
+  } catch(e) {}
+  try {
+    document.execCommand("underline");
+  } catch(e) {}
+  try {
+    document.execCommand("insertParagraph");
+  } catch(e) {}
+  try {
+    document.execCommand("delete");
+  } catch(e) {}
+
+  document.documentElement.removeAttribute("class");
+}
+addEventListener("load", onLoad);
+]]>
+</script>
+
+</html>
diff --git a/editor/libeditor/crashtests/639736-1.xhtml b/editor/libeditor/crashtests/639736-1.xhtml
new file mode 100644
index 0000000000..1aea3040e0
--- /dev/null
+++ b/editor/libeditor/crashtests/639736-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // <td> which is the deepest last child of the <body>.
+  getSelection().collapse(
+    document.querySelector("td"),
+    document.querySelector("td").childNodes.length
+  );
+  try {
+    document.execCommand("removeformat");
+  } catch(e) {}
+  document.adoptNode(document.documentElement);
+}
+</script>
+</head>
+<body onload="onLoad();"><td contenteditable="true"/></body>
+</html>
diff --git a/editor/libeditor/crashtests/713427-2.xhtml b/editor/libeditor/crashtests/713427-2.xhtml
new file mode 100644
index 0000000000..39ac18ed07
--- /dev/null
+++ b/editor/libeditor/crashtests/713427-2.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boom()
+{
+  while (document.documentElement.firstChild) {
+    document.documentElement.firstChild.remove();
+  }
+
+  var td = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
+  td.setAttributeNS(null, "contenteditable", "true");
+  (document.documentElement).appendChild(td);
+  var head = document.createElementNS("http://www.w3.org/1999/xhtml", "head");
+  (document.documentElement).appendChild(head);
+
+  head.appendChild(td);
+}
+
+window.addEventListener("load", boom);
+
+]]>
+</script>
+</head>
+
+<body></body>
+</html>
diff --git a/editor/libeditor/crashtests/766360.html b/editor/libeditor/crashtests/766360.html
new file mode 100644
index 0000000000..76c30456d6
--- /dev/null
+++ b/editor/libeditor/crashtests/766360.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var r = document.createRange();
+  r.setEnd(document.createTextNode("x"), 0);
+  window.getSelection().addRange(r);
+  document.execCommand("inserthtml", false, "y");
+}
+
+</script>
+</head>
+
+<body contenteditable="true" onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/766387.html b/editor/libeditor/crashtests/766387.html
new file mode 100644
index 0000000000..a819bf7f89
--- /dev/null
+++ b/editor/libeditor/crashtests/766387.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function onLoad() {
+  const editingHost = document.querySelectorAll("div[contenteditable]");
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // last <div contenteditable> which is the deepest last child of the <body>.
+  getSelection().collapse(editingHost[1], editingHost[1].childNodes.length);
+  getSelection().removeAllRanges();
+  const r = document.createRange();
+  r.setStart(editingHost[0], 1);
+  r.setEnd(editingHost[1], 0);
+  getSelection().addRange(r);
+  document.execCommand("insertOrderedList");
+}
+</script>
+</head>
+
+<body onload="onLoad();"><div contenteditable>a</div><div contenteditable></div></body>
+</html>
diff --git a/editor/libeditor/crashtests/766413.html b/editor/libeditor/crashtests/766413.html
new file mode 100644
index 0000000000..1a7092d92a
--- /dev/null
+++ b/editor/libeditor/crashtests/766413.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var root = document.documentElement;
+  while (root.firstChild) {
+    root.firstChild.remove();
+  }
+
+  var space = document.createTextNode(" ");
+  var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+  root.contentEditable = "true";
+  root.focus();
+  document.execCommand("contentReadOnly", false, null);
+  root.appendChild(body);
+  root.contentEditable = "false";
+  root.appendChild(space);
+  root.removeChild(body);
+  root.contentEditable = "true";
+
+  window.getSelection().removeAllRanges();
+  var r1 = document.createRange();
+  r1.setStart(root, 0);
+  r1.setEnd(root, 0);
+  window.getSelection().addRange(r1);
+  looseText = document.createTextNode("c");
+  var r2 = document.createRange();
+  r2.setStart(looseText, 0);
+  r2.setEnd(looseText, 0);
+  window.getSelection().addRange(r2);
+
+  document.execCommand("forwardDelete", false, null);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/766795.html b/editor/libeditor/crashtests/766795.html
new file mode 100644
index 0000000000..b4ade30209
--- /dev/null
+++ b/editor/libeditor/crashtests/766795.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var fragEl = document.createElement("span");
+  fragEl.setAttribute("contenteditable", "true");
+  fragEl.setAttribute("style", "position: absolute;");
+
+  var frag = document.createDocumentFragment();
+  frag.appendChild(fragEl);
+
+  window.getSelection().selectAllChildren(fragEl);
+}
+
+</script>
+</head>
+
+<body contenteditable="true" onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/766845.xhtml b/editor/libeditor/crashtests/766845.xhtml
new file mode 100644
index 0000000000..409e210109
--- /dev/null
+++ b/editor/libeditor/crashtests/766845.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boom()
+{
+  window.getSelection().removeAllRanges();
+  var r1 = document.createRange();
+  r1.setStart(document.body, 0);
+  r1.setEnd  (document.body, 1);
+  window.getSelection().addRange(r1);
+  var r2 = document.createRange();
+  r2.setStart(document.body, 1);
+  r2.setEnd  (document.body, 2);
+  window.getSelection().addRange(r2);
+  if (document.queryCommandEnabled("inserthtml"))
+    document.execCommand("inserthtml", false, "1");
+}
+
+]]>
+</script>
+</head>
+
+<body contenteditable="true" onload="boom();"><div></div><div></div></body>
+
+</html>
diff --git a/editor/libeditor/crashtests/767169.html b/editor/libeditor/crashtests/767169.html
new file mode 100644
index 0000000000..a7673bce62
--- /dev/null
+++ b/editor/libeditor/crashtests/767169.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<script>
+
+// Document must not have a doctype to trigger the bug
+
+function boom()
+{
+  var root = document.documentElement;
+  while (root.firstChild) { root.firstChild.remove(); }
+  root.contentEditable = "true";
+  document.removeChild(root);
+  document.appendChild(root);
+  window.getSelection().collapse(root, 0);
+  window.getSelection().extend(document, 1);
+  document.removeChild(root);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/768748.html b/editor/libeditor/crashtests/768748.html
new file mode 100644
index 0000000000..09206dce3f
--- /dev/null
+++ b/editor/libeditor/crashtests/768748.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html contenteditable="true">
+<head>
+<script>
+
+function boom()
+{
+  var looseText = document.createTextNode("x");
+  window.getSelection().collapse(looseText, 0);
+  document.queryCommandState("insertorderedlist");
+}
+
+</script>
+</head>
+<body onload="setTimeout(boom, 0)"></body>
+</html>
diff --git a/editor/libeditor/crashtests/768765.html b/editor/libeditor/crashtests/768765.html
new file mode 100644
index 0000000000..551e4ec6c3
--- /dev/null
+++ b/editor/libeditor/crashtests/768765.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var root = document.documentElement;
+
+  while (root.firstChild) { root.firstChild.remove(); }
+
+  var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+  var div = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  root.contentEditable = "true";
+  root.appendChild(div);
+  root.removeChild(div);
+  root.insertBefore(body, root.firstChild);
+
+  window.getSelection().removeAllRanges();
+  var r0 = document.createRange();
+  r0.setStart(body, 0);
+  r0.setEnd(body, 0);
+  window.getSelection().addRange(r0);
+  var r1 = document.createRange();
+  r1.setStart(div, 0);
+  r1.setEnd(div, 0);
+  window.getSelection().addRange(r1);
+
+  document.execCommand("inserthtml", false, "1");
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/769008-1.html b/editor/libeditor/crashtests/769008-1.html
new file mode 100644
index 0000000000..8ea8a3601d
--- /dev/null
+++ b/editor/libeditor/crashtests/769008-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var x = document.getElementById("x");
+
+  window.getSelection().removeAllRanges();
+
+  var range = document.createRange();
+  range.setStart(x, 0);
+  range.setEnd(x, 0);
+  window.getSelection().addRange(range);
+
+  document.execCommand("delete", false, "null");
+}
+
+</script>
+</head>
+<body contenteditable="true" onload="boom();"><div></div><span id="x"></span></body>
+</html>
diff --git a/editor/libeditor/crashtests/769967.xhtml b/editor/libeditor/crashtests/769967.xhtml
new file mode 100644
index 0000000000..af07571591
--- /dev/null
+++ b/editor/libeditor/crashtests/769967.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml" contenteditable="true" style="user-select: all;"><sub>x</sub><script>
+function boom()
+{
+  window.getSelection().removeAllRanges();
+  var r = document.createRange();
+  r.setStart(document.documentElement, 0);
+  r.setEnd(document.documentElement, 0);
+  window.getSelection().addRange(r);
+
+  document.execCommand("subscript", false, null);
+  document.execCommand("insertText", false, "y");
+}
+
+window.addEventListener("load", boom, false);
+
+</script></html>
diff --git a/editor/libeditor/crashtests/771749.html b/editor/libeditor/crashtests/771749.html
new file mode 100644
index 0000000000..9237364f2d
--- /dev/null
+++ b/editor/libeditor/crashtests/771749.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var root = document.documentElement;
+  root.contentEditable = "true";
+  document.removeChild(root);
+  document.appendChild(root);
+  document.execCommand("insertunorderedlist", false, null);
+  document.execCommand("inserthtml", false, "<span></span>");
+  document.execCommand("outdent", false, null);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/772282.html b/editor/libeditor/crashtests/772282.html
new file mode 100644
index 0000000000..bba3d6bd67
--- /dev/null
+++ b/editor/libeditor/crashtests/772282.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var root = document.documentElement;
+  while(root.firstChild) { root.firstChild.remove(); }
+  var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+  body.setAttributeNS(null, "contenteditable", "true");
+  var img = document.createElementNS("http://www.w3.org/1999/xhtml", "img");
+  body.appendChild(img);
+  root.appendChild(body);
+  document.removeChild(root);
+  document.appendChild(root);
+  document.execCommand("insertText", false, "5");
+  document.execCommand("selectAll", false, null);
+  document.execCommand("insertParagraph", false, null);
+  document.execCommand("increasefontsize", false, null);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/776323.html b/editor/libeditor/crashtests/776323.html
new file mode 100644
index 0000000000..9fc2776c37
--- /dev/null
+++ b/editor/libeditor/crashtests/776323.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html contenteditable="true">
+<head>
+<script>
+
+function boom()
+{
+  document.execCommand("inserthtml", false, "b");
+  var myrange = document.createRange();
+  myrange.selectNodeContents(document.getElementsByTagName("img")[0]);
+  window.getSelection().addRange(myrange);
+  document.execCommand("strikethrough", false, null);
+}
+
+</script>
+</head>
+<body onload="boom();"><img></body>
+</html>
diff --git a/editor/libeditor/crashtests/793866.html b/editor/libeditor/crashtests/793866.html
new file mode 100644
index 0000000000..4984474dbc
--- /dev/null
+++ b/editor/libeditor/crashtests/793866.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var b = document.body;
+  b.contentEditable = "true";
+  document.execCommand("contentReadOnly", false, null);
+  b.focus();
+  b.contentEditable = "false";
+  document.documentElement.contentEditable = "true";
+  document.createDocumentFragment().appendChild(b);
+  document.documentElement.focus();
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/848644.html b/editor/libeditor/crashtests/848644.html
new file mode 100644
index 0000000000..95570fabe3
--- /dev/null
+++ b/editor/libeditor/crashtests/848644.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<iframe src="data:text/html;charset=utf-8;base64,PGh0bWw+CjxoZWFkPgoJPHNjcmlwdD4KCQoJCXZhciBuID0gMDsKCQkKICAgICAgICB2YXIgU3ByYXkgPSBbXTsgICAgICAgICAgICAKICAgICAgICB2YXIgblNwcmF5ID0gMHgxMDA7ICAgICAgICAKCiAgICAKICAgIGZ1bmN0aW9uIHB0clRvU3RyaW5nKHB0cikKICAgIHsKICAgICAgICB2YXIgdGVtcCA9IHB0ci50b1N0cmluZygxNik7CiAgICAgICAgd2hpbGUgKHRlbXAubGVuZ3RoIDwgOCkKICAgICAgICAgICAgdGVtcCA9ICIwIiArIHRlbXA7CiAgICAgICAgYWQgPSAiJXUiOwogICAgICAgIGZvciAodmFyIGk9MDsgaTw0OyBpKyspCiAgICAgICAgICAgIGFkID0gYWQgKyB0ZW1wLmNoYXJBdCg0K2kpOwogICAgICAgIGFkICs9ICIldSI7CiAgICAgICAgZm9yICh2YXIgaT0wOyBpPDQ7IGkrKykKICAgICAgICAgICAgYWQgPSBhZCArIHRlbXAuY2hhckF0KGkpOwogICAgICAgIHJldHVybiBhZDsKICAgIH0KCiAgICAgICBmdW5jdGlvbiBzcHJheU1lbW9yeSgpCiAgICB7CiAgICAgICAgdmFyIHBhZ2Vfc2l6ZSA9IDB4MTAwMDAwIC0gMHgxMDAwOwogICAgICAgIHZhciBibG9jayA9ICIiOwoKICAgICAgICB3aGlsZSAoYmxvY2subGVuZ3RoICogMiA8IDB4MEM0KzB4MjAyMCkKICAgICAgICAgICAgYmxvY2sgKz0gcGFjaygweDkwOTA5MDkwKTsKICAgICAgICAKICAgICAgICB3aGlsZSAoYmxvY2subGVuZ3RoICogMiA8IHBhZ2Vfc2l6ZSkKICAgICAgICAgICAgYmxvY2sgKz0gIlx1OTA5MFx1OTA5MCI7CiAgICAgICAgICAgIAogICAgICAgIHZhciBzcHIgPSBibG9jay5zdWJzdHJpbmcoMCwgcGFnZV9zaXplIC8gMik7CiAgICAgICAgCiAgICAgICAgZm9yICh2YXIgaSA9IDA7IGkgPCBuU3ByYXk7IGkrKykKICAgICAgICAgICAgU3ByYXlbaV0gPSBbc3ByXS5qb2luKCIiKTsKICAgIH0KICAgICAgICAKCQlmdW5jdGlvbiBwYWNrKGEpCgkJewoJCQlyZXR1cm4gU3RyaW5nLmZyb21DaGFyQ29kZShhICYgMHhGRkZGKSArIFN0cmluZy5mcm9tQ2hhckNvZGUoYSA+PiAxNik7CgkJfQoJCQoJCXZhciAkID0gZnVuY3Rpb24oaWQpIHsgcmV0dXJuIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKGlkKTsgfQoJCQoJCXZhciBhbGxvYyA9IGZ1bmN0aW9uKHN6LCBwYXR0ZXJuPSdcdTQxNDEnKQoJCXsKCQkJc3ogLT0gMjsKCQkJaWYgKHN6IDwgMCkKCQkJCXJldHVybiBudWxsOwoJCQkKCQkJdmFyIHN0ciA9IHBhdHRlcm47CgkJCXdoaWxlIChzdHIubGVuZ3RoICogMiA8IHN6KQoJCQkJc3RyICs9IHBhdHRlcm47CgkJCgkJCXJldHVybiBzdHIuc3Vic3RyaW5nKDAsIHN6LzIpOwoJCX0KCQkKCQlmdW5jdGlvbiBhcHBlbmRJbnB1dChuLCB3aXRoSWRzPWZhbHNlKSAKCQl7CgkJCXZhciBib2R5ID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiYm9keSIpCgkJCXZhciBibG9jayA9IHBhY2soMHgyMDIwMjAyMCk7CgkJCXdoaWxlIChibG9jay5sZW5ndGggKiAyIDwgMHg1NCkKCQkJCWJsb2NrICs9IHBhY2soMHgyMDIwMjAyMCk7CgkJCWJsb2NrICs9IHBhY2soMHgyMDIwMjAyMCk7CgkJCXdoaWxlIChibG9jay5sZW5ndGggKiAyIDwgMHhDNCkKCQkJCWJsb2NrICs9IHBhY2soMHgyMDIwMjAyMCk7CgkJCWJsb2NrICs9IHBhY2soMHgyMDIwMjAyMCk7CgkJCXdoaWxlIChibG9jay5sZW5ndGggKiAyIDwgMHgyRDQgLSAyKQoJCQkJYmxvY2sgKz0gcGFjaygweDIwMjAyMDIwKTsKCQkgICAgdmFyIGIgPSBibG9jay5zdWJzdHJpbmcoMCwgMHgyRDIpOwoJCQlmb3IgKHZhciBpID0wOyBpPG47IGkrKykgCgkJCXsKCQkJCXZhciBpbnB1dCA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ2lucHV0JykKCQkJCWlmICh3aXRoSWRzID09IHRydWUpCgkJCQkJaW5wdXQuc2V0QXR0cmlidXRlKCdpZCcsICdpbnB1dCcgKyBpKTsKCQkJCWlucHV0LnZhbHVlID0gYgoJCQkJZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChpbnB1dCkKCQkJfQoJCX0KCQkKCQlmdW5jdGlvbiBjcmFmdEhlYXAobikKCQl7CgkJCWFwcGVuZElucHV0KG4sIHRydWUpOwoJCQlmb3IgKHZhciBpID0gMDsgaSA8IG47IGkgKz0gMikKCQkJCWRvY3VtZW50LmJvZHkucmVtb3ZlQ2hpbGQoJCgnaW5wdXQnICsgaSkpOwoJCX0KCQkKCQlmdW5jdGlvbiBzdGFydEZ1bigpCgkJewogICAgICAgICAgICAgICAgICAgICAgICBkb2N1bWVudC5kb2N1bWVudEVsZW1lbnQuZ2V0Qm91bmRpbmdDbGllbnRSZWN0KCk7CgkJCWNyYWZ0SGVhcCgweDEwKTsKCQkJZG9jdW1lbnQuZGVzaWduTW9kZSA9ICJvbiI7CgkJCWRvY3VtZW50LmRvY3VtZW50RWxlbWVudC5zdHlsZS5oZWlnaHQgPSAiMjAwcHgiOwoJCQkkKCdpZDEnKS5vZmZzZXRUb3A7CgkJfQoJCQoJCQoJCWZ1bmN0aW9uIGNhbGNNZUJhYmUoKQoJCXsKCQkJbisrOwoJCQlkb2N1bWVudC5leGVjQ29tbWFuZCgiaW5zZXJ0T3JkZXJlZExpc3QiLGZhbHNlLHRydWUpOwoJCQlkb2N1bWVudC53cml0ZSgnQUFBQUFBQUFBQUFBJyk7CQkKICAgICAgICAgICAgc3ByYXlNZW1vcnkoKTsKCQkJYXBwZW5kSW5wdXQoMHgxMDApOwoJCQkKCQkJZG9jdW1lbnQuZG9jdW1lbnRFbGVtZW50LnN0eWxlLmhlaWdodCA9ICIzMDBweCI7CgkJCWlmIChuID09IDIpCgkJCXsKICAgICAgICAgICAgICAgIHdpbmRvdy5yZW1vdmVFdmVudExpc3RlbmVyKCJyZXNpemUiLCBjYWxjTWVCYWJlLCBmYWxzZSk7CgkJCQloaXN0b3J5LmdvKC0xKTsKCQkJfQoKCQl9CgkJd2luZG93LmFkZEV2ZW50TGlzdGVuZXIoInJlc2l6ZSIsIGNhbGNNZUJhYmUsIGZhbHNlKTsKCTwvc2NyaXB0Pgo8L2hlYWQ+Cgk8Ym9keT4KCQk8ZGl2IGlkPSdpZDEnPiAgICA8L2Rpdj4KCQk8c2NyaXB0PnN0YXJ0RnVuKCk7PC9zY3JpcHQ+Cgk8L2JvZHk+CjwvaHRtbD4K" style="width: 100px; height: 100px"></iframe>
diff --git a/editor/libeditor/crashtests/crashtests.list b/editor/libeditor/crashtests/crashtests.list
new file mode 100644
index 0000000000..bc9b7a3f2d
--- /dev/null
+++ b/editor/libeditor/crashtests/crashtests.list
@@ -0,0 +1,117 @@
+load 336081-1.xhtml
+load 403965-1.xhtml
+load 428489-1.html
+load 429586-1.html
+load 431086-1.xhtml
+load 475132-1.xhtml
+load 503709-1.xhtml
+load 513375-1.xhtml
+load 535632-1.xhtml
+load 574558-1.xhtml
+load 580151-1.xhtml
+load 582138-1.xhtml
+load 633709.xhtml
+load 639736-1.xhtml
+load 713427-2.xhtml
+load 766360.html
+load 766387.html
+load 766413.html
+load 766795.html
+load 766845.xhtml
+load 767169.html
+load 768748.html
+load 768765.html
+load 769008-1.html
+load 769967.xhtml
+needs-focus load 771749.html
+load 772282.html
+load 776323.html
+needs-focus load 793866.html
+load 848644.html
+load 1057677.html
+needs-focus load 1128787.html
+load 1134545.html
+load 1158452.html
+load 1158651.html
+load 1244894.xhtml
+load 1264921.html
+load 1272490.html
+load 1274050.html
+load 1317704.html
+load 1317718.html
+load 1324505.html
+needs-focus load 1343918.html
+load 1344097.html
+load 1345015.html
+load 1348851.html
+load 1350772.html
+load 1364133.html
+load 1366176.html
+load 1375131.html
+load 1381541.html
+load 1383747.html
+load 1383755.html
+load 1383763.html
+load 1384161.html
+load 1388075.html
+load 1393171.html
+needs-focus load 1402196.html
+load 1402469.html
+load 1402526.html
+pref(dom.document.exec_command.nested_calls_allowed,true) asserts(1) load 1402904.html # assertion is that mutation event listener caused by execCommand calls another execCommand
+pref(dom.document.exec_command.nested_calls_allowed,true) asserts(1) load 1405747.html # assertion is that mutation event listener caused by execCommand calls another execCommand
+load 1405897.html
+load 1408170.html
+asserts(0-1) load 1414581.html
+load 1415231.html
+load 1423767.html
+needs-focus load 1423776.html
+skip-if(ThreadSanitizer) needs-focus load 1424450.html # bug 1718775, permafail on tsan
+load 1425091.html
+load 1426709.html
+needs-focus load 1429523.html
+needs-focus load 1429523.xhtml
+load 1441619.html
+load 1443664.html
+skip-if(Android) needs-focus load 1444630.html
+load 1446451.html
+pref(dom.document.exec_command.nested_calls_allowed,true) load 1464251.html
+pref(layout.accessiblecaret.enabled,true) load 1470926.html
+pref(dom.document.exec_command.nested_calls_allowed,true) asserts(2) load 1474978.html # assertion is that mutation event listener caused by execCommand calls another execCommand
+load 1517028.html
+load 1525481.html
+load 1533913.html
+load 1534394.html
+load 1547897.html
+load 1547898.html
+load 1556799.html
+load 1579934.html
+load 1574544.html
+load 1578916.html
+load 1581246.html
+load 1596516.html
+load 1605741.html
+load 1613521.html
+load 1618906.html
+load 1623166.html
+load 1623913.html
+load 1624005.html # throws
+load 1624007.html
+load 1624011.html
+load 1626002.html
+load 1636541.html
+load 1644903.html
+load 1645983-1.html
+load 1645983-2.html
+load 1648564.html
+load 1655539.html
+load 1659717.html
+load 1663725.html # throws
+load 1655508.html
+load 1655988.html
+pref(dom.document.exec_command.nested_calls_allowed,true) load 1666556.html
+load 1677566.html
+load 1691051.html
+load 1699866.html
+load 1701348.html
+load 1707630.html
-- 
cgit v1.2.3