From 26a029d407be480d791972afb5975cf62c9360a6 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Fri, 19 Apr 2024 02:47:55 +0200
Subject: Adding upstream version 124.0.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 ...ested-editing-host-td-from-DOMAttrModified.html |  29 ++++++
 .../tests/editing/crashtests/bold-in-output.html   |  20 ++++
 ...used-text-control-and-make-it-editing-host.html |  16 +++
 ...le-will-be-blurred-by-focus-event-listener.html |  16 +++
 .../tests/editing/crashtests/crash-test.html       |  24 +++++
 .../delete-after-empty-script-element.html         |  19 ++++
 ...fter-justifyleft-in-closed-editable-dialog.html |  17 +++
 ...-recursively-with-mutation-event-listeners.html |  34 ++++++
 .../delete-at-next-to-svg-display-table-cell.html  |  18 ++++
 ...delete-at-start-of-first-li-in-ol-in-video.html |  24 +++++
 .../crashtests/delete-at-text-following-svg.html   |  41 ++++++++
 .../delete-content-in-no-data-object.html          |  31 ++++++
 ...m-after-empty-table-header-grouped-element.html |  16 +++
 .../delete-from-ruby-at-start-of-button.html       |  29 ++++++
 ...iately-after-changing-input-type-from-time.html |  23 ++++
 .../crashtests/delete-in-block-in-progress.html    |  25 +++++
 ...dd-editing-host-after-selectall-with-focus.html |  12 +++
 ...editing-host-after-selectall-without-focus.html |  12 +++
 ...esignMode-without-explicitly-setting-focus.html |  17 +++
 ...ble-list-followed-by-non-editable-listitem.html |  13 +++
 ...nt-will-be-blurred-by-focus-event-listener.html |  18 ++++
 ...designMode-off-during-inserthorizontalrule.html |  22 ++++
 .../designMode-on-of-lazy-loading-iframe.html      |  20 ++++
 ...Command-at-load-with-changing-editing-host.html |  17 +++
 ...-hilitecolor-in-empty-iframe-in-designMode.html | 116 +++++++++++++++++++++
 .../execCommand-without-selection-ranges.html      |  65 ++++++++++++
 ...ock-selection-containing-non-editable-list.html |  18 ++++
 ...e-after-editable-slot-element-outside-body.html |  28 +++++
 .../forwarddelete-at-empty-text-node-in-body.html  |   8 ++
 ...warddelete-delete-after-justifyleft-indent.html |  20 ++++
 ...st-editing-host-after-selectall-with-focus.html |  15 +++
 ...editing-host-after-selectall-without-focus.html |  15 +++
 ...n-text-in-span-in-editable-documentElement.html |  15 +++
 ...indent-in-inline-editing-host-outside-body.html |  18 ++++
 ...t-in-textarea-in-designMode-during-outdent.html |  34 ++++++
 ...dent-after-closing-editable-dialog-element.html |  31 ++++++
 ...image-with-joining-header-element-and-body.html |  24 +++++
 ...ertAdjacentElement-with-DOMSubtreeModified.html |  26 +++++
 .../insertText-at-end-of-text-in-body.html         |  16 +++
 .../insertText-nested-by-DOMSubtreeModified.html   |  29 ++++++
 ...dset-and-everything-styled-white-space-pre.html |  25 +++++
 ...extarea-in-editor-and-undo-on-error-events.html |  31 ++++++
 ...2-selection-ranges-and-one-is-outside-body.html |  19 ++++
 ...nding-in-collapsible-spaces-before-comment.html |  25 +++++
 ...le-with-selecting-text-in-document-element.html |  18 ++++
 ...fter-temporarily-removing-document-element.html |  27 +++++
 ...thtml-in-inline-editing-host-at-load-event.html |   7 ++
 .../crashtests/inserthtml-in-li-in-option.html     |  25 +++++
 ...serthtml-in-text-adopted-to-other-document.html |  52 +++++++++
 ...en-input-element-in-editing-host-has-focus.html |  18 ++++
 ...to-replace-root-list-element-in-designMode.html |  33 ++++++
 ...ith-replacing-selection-in-picture-element.html |  47 +++++++++
 .../insertlinebreak-around-comment-node.html       |  20 ++++
 ...nsertlinebreak-in-map-element-editing-host.html |  12 +++
 ...orderedlist-in-focused-inline-editing-host.html |  23 ++++
 ...eredlist-in-text-adopted-to-other-document.html |  49 +++++++++
 ...OMNodeInserted-caused-by-insertorderedlist.html |  23 ++++
 ...item-in-svg-followed-by-collapsible-spaces.html |  28 +++++
 ...nsertparagraph-in-map-element-editing-host.html |  12 +++
 .../inserttext-at-start-with-different-style.html  |  20 ++++
 .../inserttext-with-clearing-subscript.html        |  31 ++++++
 ...unorderedlist-in-empty-inline-editing-host.html |  17 +++
 ...tunorderedlist-in-empty-table-editing-host.html |  22 ++++
 .../crashtests/justifycenter-around-textarea.html  |  14 +++
 ...hen-delete-selection-on-DOMSubtreeModified.html |  24 +++++
 ...-everything-styled-white-space-break-space.html |  18 ++++
 ...hile-iframe-sets-spellcheck-attr-from-load.html |  13 +++
 ...-and-set-contenteditable-of-input-to-false.html |  19 ++++
 ...r-making-focused-editing-host-non-editable.html |  21 ++++
 ...ost-to-subdocument-when-textarea-has-focus.html |  15 +++
 ...ditinghost-to-outside-on-input-of-embolden.html |  22 ++++
 ...egend-followed-by-textarea-into-orphan-div.html |  15 +++
 .../editing/crashtests/mozilla-bug-1851730.html    |  11 ++
 ...xecCommand-calls-after-interting-long-text.html |  20 ++++
 .../crashtests/non-root-editable-html-element.html |   7 ++
 ..._DOMSubtreeModified_during_insertparagraph.html |  16 +++
 .../crashtests/outdent-across-svg-boundary.html    |  38 +++++++
 ...host-containing-combining-diacritical-mark.html |  16 +++
 .../outdent-in-empty-body-editing-host.html        |   7 ++
 ...nt-in-meter-indented-by-legend-in-css-mode.html |  25 +++++
 ...nt-inserthorizontalrule-on-selectionchange.html |  23 ++++
 ...-hilitecolor-in-empty-iframe-in-designMode.html |  73 +++++++++++++
 ...or-in-empty-iframe-in-designMode-from-load.html |  21 ++++
 ...oving-html-element-in-designMode-from-load.html |   8 ++
 ...ement-with-new-one-in-designMode-from-load.html |   8 ++
 ...ent-element-of-iframe-having-style-content.html |  17 +++
 .../remove-editing-host-during-forwarddelete.html  |  65 ++++++++++++
 ...-editing-host-on-DOMNodeInserted-at-indent.html |  24 +++++
 .../remove-editing-host-which-is-selected.html     |  17 +++
 .../crashtests/remove-iframe-for-designMode.html   |  21 ++++
 .../remove-parent-element-during-inserthtml.html   |  24 +++++
 ...lock-during-joining-with-parent-left-block.html |  33 ++++++
 .../removeformat-from-DOMNodeRemoved.html          |  29 ++++++
 ...t-immediately-after-type-change-and-stepUp.html |  20 ++++
 ...ocumentElement-after-inserthtml-svg-and-td.html |  15 +++
 .../replace-document-root-with-object-and-mo.html  |  19 ++++
 ...rent-of-editing-host-on-DOMSubtreeModified.html |  28 +++++
 ...all-and-inerthtml-in-textarea-editing-host.html |  15 +++
 ...ll-in-head-editing-host-after-body-removed.html |  19 ++++
 ...eboundary-selectall-around-editable-canvas.html |  12 +++
 ...ion-modify-around-input-in-contenteditable.html |  22 ++++
 ...rd-character-to-outside-body-in-designMode.html |  10 ++
 ...-value-of-editing-host-after-changing-type.html |  15 +++
 ...-value-to-empty-while-deleting-its-content.html |  33 ++++++
 ...ange-after-updating-textarea-default-value.html |  16 +++
 ...document-containing-misspelled-word-iframe.html |   1 +
 ...ea-will-be-blurred-by-focus-event-listener.html |  16 +++
 ...-in-subdocument-containing-misspelled-word.html |  11 ++
 .../update-dom-during-undoing-in-textarea.html     |  32 ++++++
 109 files changed, 2523 insertions(+)
 create mode 100644 testing/web-platform/tests/editing/crashtests/backcolor-in-nested-editing-host-td-from-DOMAttrModified.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/bold-in-output.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/change-input-type-of-focused-text-control-and-make-it-editing-host.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/contenteditable-will-be-blurred-by-focus-event-listener.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/crash-test.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/delete-after-empty-script-element.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/delete-after-justifyleft-in-closed-editable-dialog.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/delete-and-justifycenter-recursively-with-mutation-event-listeners.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/delete-at-next-to-svg-display-table-cell.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/delete-at-start-of-first-li-in-ol-in-video.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/delete-at-text-following-svg.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/delete-content-in-no-data-object.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/delete-from-after-empty-table-header-grouped-element.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/delete-from-ruby-at-start-of-button.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/delete-immediately-after-changing-input-type-from-time.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/delete-in-block-in-progress.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-with-focus.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-without-focus.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/delete-in-designMode-without-explicitly-setting-focus.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/delete-in-empty-editable-list-followed-by-non-editable-listitem.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/designMode-document-will-be-blurred-by-focus-event-listener.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/designMode-off-during-inserthorizontalrule.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/designMode-on-of-lazy-loading-iframe.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/execCommand-at-load-with-changing-editing-host.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/execCommand-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/execCommand-without-selection-ranges.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/format-block-selection-containing-non-editable-list.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/forwarddelete-after-editable-slot-element-outside-body.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/forwarddelete-at-empty-text-node-in-body.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/forwarddelete-delete-after-justifyleft-indent.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-with-focus.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-without-focus.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/forwarddelete-in-text-in-span-in-editable-documentElement.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/indent-in-inline-editing-host-outside-body.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/indent-in-textarea-in-designMode-during-outdent.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/indent-outdent-after-closing-editable-dialog-element.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/insert-image-with-joining-header-element-and-body.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/insertAdjacentElement-with-DOMSubtreeModified.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/insertText-at-end-of-text-in-body.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/insertText-nested-by-DOMSubtreeModified.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-fieldset-and-everything-styled-white-space-pre.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-textarea-in-editor-and-undo-on-error-events.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-2-selection-ranges-and-one-is-outside-body.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-range-ending-in-collapsible-spaces-before-comment.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-selecting-text-in-document-element.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/inserthtml-after-temporarily-removing-document-element.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/inserthtml-in-inline-editing-host-at-load-event.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/inserthtml-in-li-in-option.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/inserthtml-in-text-adopted-to-other-document.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/inserthtml-indent-delete-when-input-element-in-editing-host-has-focus.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/inserthtml-to-replace-root-list-element-in-designMode.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/insertimage-with-replacing-selection-in-picture-element.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/insertlinebreak-around-comment-node.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/insertlinebreak-in-map-element-editing-host.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/insertorderedlist-in-focused-inline-editing-host.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/insertorderedlist-in-text-adopted-to-other-document.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/insertparagraph-from-DOMNodeInserted-caused-by-insertorderedlist.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/insertparagraph-in-listitem-in-svg-followed-by-collapsible-spaces.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/insertparagraph-in-map-element-editing-host.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/inserttext-at-start-with-different-style.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/inserttext-with-clearing-subscript.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-inline-editing-host.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-table-editing-host.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/justifycenter-around-textarea.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/justifycenter-then-delete-selection-on-DOMSubtreeModified.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/justifyfull-selection-containing-non-editable-div-and-everything-styled-white-space-break-space.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/loading-different-page-in-iframe-while-iframe-sets-spellcheck-attr-from-load.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/make-editable-div-inline-and-set-contenteditable-of-input-to-false.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/make-parent-element-editable-after-making-focused-editing-host-non-editable.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/move-editing-host-to-subdocument-when-textarea-has-focus.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/move-first-element-from-editinghost-to-outside-on-input-of-embolden.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/move-legend-followed-by-textarea-into-orphan-div.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/mozilla-bug-1851730.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/multiple-execCommand-calls-after-interting-long-text.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/non-root-editable-html-element.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/normalize_document_at_DOMSubtreeModified_during_insertparagraph.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/outdent-across-svg-boundary.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/outdent-editing-host-containing-combining-diacritical-mark.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/outdent-in-empty-body-editing-host.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/outdent-in-meter-indented-by-legend-in-css-mode.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/outdent-indent-inserthorizontalrule-on-selectionchange.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-in-empty-iframe-in-designMode-from-load.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/queryCommandState-backcolor-after-removing-html-element-in-designMode-from-load.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/queryCommandValue-backcolor-after-replacing-html-element-with-new-one-in-designMode-from-load.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/remove-document-element-of-iframe-having-style-content.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/remove-editing-host-during-forwarddelete.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/remove-editing-host-on-DOMNodeInserted-at-indent.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/remove-editing-host-which-is-selected.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/remove-iframe-for-designMode.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/remove-parent-element-during-inserthtml.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/remove-right-block-during-joining-with-parent-left-block.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/removeformat-from-DOMNodeRemoved.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/removeformat-in-number-input-immediately-after-type-change-and-stepUp.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/remve-documentElement-after-inserthtml-svg-and-td.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/replace-document-root-with-object-and-mo.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/replace-parent-of-editing-host-on-DOMSubtreeModified.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/selectall-and-inerthtml-in-textarea-editing-host.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/selectall-in-head-editing-host-after-body-removed.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/selectall-selection-modify-move-forward-lineboundary-selectall-around-editable-canvas.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/selection-modify-around-input-in-contenteditable.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/selection-modify-extend-backward-character-to-outside-body-in-designMode.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/set-input-value-of-editing-host-after-changing-type.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/set-output-value-to-empty-while-deleting-its-content.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/set-selection-range-after-updating-textarea-default-value.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/support/unloading-editor-in-subdocument-containing-misspelled-word-iframe.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/textarea-will-be-blurred-by-focus-event-listener.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/unloading-editor-in-subdocument-containing-misspelled-word.html
 create mode 100644 testing/web-platform/tests/editing/crashtests/update-dom-during-undoing-in-textarea.html

(limited to 'testing/web-platform/tests/editing/crashtests')

diff --git a/testing/web-platform/tests/editing/crashtests/backcolor-in-nested-editing-host-td-from-DOMAttrModified.html b/testing/web-platform/tests/editing/crashtests/backcolor-in-nested-editing-host-td-from-DOMAttrModified.html
new file mode 100644
index 0000000000..f8f004b910
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/backcolor-in-nested-editing-host-td-from-DOMAttrModified.html
@@ -0,0 +1,29 @@
+<html class="test-wait">
+<head>
+<script type="text/javascript">
+function boom()
+{
+  function x()
+  {
+    document.removeEventListener("DOMAttrModified", x);
+    document.execCommand("backcolor", false, "green");
+  }
+
+  document.getElementById("td").focus();
+
+  document.addEventListener("DOMAttrModified", x);
+  try {
+    document.execCommand("subscript", false, null);
+  } catch(e) {
+  }
+  document.removeEventListener("DOMAttrModified", x);
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+
+<body contenteditable="true" onload="setTimeout(boom, 30);">
+<table><tbody contenteditable="false"><tr><td contenteditable="true" id="td"></td></tr></tbody></table>
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/bold-in-output.html b/testing/web-platform/tests/editing/crashtests/bold-in-output.html
new file mode 100644
index 0000000000..43d78ec4e9
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/bold-in-output.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<style>
+* { font-weight: bolder }
+</style>
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  document.querySelector("output").focus();
+  document.execCommand("selectAll");
+  document.execCommand("bold");
+})
+</script>
+</head>
+<body>
+<output contenteditable="true">
+A
+</output></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/change-input-type-of-focused-text-control-and-make-it-editing-host.html b/testing/web-platform/tests/editing/crashtests/change-input-type-of-focused-text-control-and-make-it-editing-host.html
new file mode 100644
index 0000000000..fec4ff13e8
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/change-input-type-of-focused-text-control-and-make-it-editing-host.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  const input = document.createElement("input");
+  document.documentElement.appendChild(input);
+  input.focus();
+  input.type = "file";
+  input.getBoundingClientRect();
+  input.setAttribute("contenteditable", "true");
+});
+</script>
+<body></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/contenteditable-will-be-blurred-by-focus-event-listener.html b/testing/web-platform/tests/editing/crashtests/contenteditable-will-be-blurred-by-focus-event-listener.html
new file mode 100644
index 0000000000..a887b1de90
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/contenteditable-will-be-blurred-by-focus-event-listener.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html class="test-wait">
+<meta charset="utf-8">
+<script>
+addEventListener("load", () => {
+  const editingHost = document.querySelector("div[contenteditable]");
+  editingHost.addEventListener("focus", () => {
+    document.execCommand("insertText", false, "def");
+    editingHost.parentElement.setAttribute("hidden", "hidden");
+    setTimeout(() => document.documentElement.removeAttribute("class"), 0);
+  });
+  editingHost.focus();
+});
+</script>
+<div><div contenteditable>abc</div></div>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/crash-test.html b/testing/web-platform/tests/editing/crashtests/crash-test.html
new file mode 100644
index 0000000000..a7baba30ec
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/crash-test.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Testcase for bug 1273593 of Chromium</title>
+<script type="text/javascript">
+    function eventhandle_n0BpsTiUS(){
+        document.getElementById('id_xEmarzXTw').getBoundingClientRect();
+        create_object_mJ9MFgX5.appendChild(document.getElementById('id_nJMWIU7Mp'));
+    }
+    function operate(){
+        document.getElementById('id_VQmNKZL69').addEventListener('pause', eventhandle_n0BpsTiUS);
+        create_object_mJ9MFgX5 = document.createElement("canvas");
+        event = new Event('pause')
+        document.getElementById('id_VQmNKZL69').dispatchEvent(event)
+    }// end exec_event
+</script>
+<body onload="operate();" contentEditable="true">
+    <menu id='id_xEmarzXTw'>
+        <i id='id_VQmNKZL69'  onfocusout='eventhandle_n0BpsTiUS();'>
+            <nobr id='id_nJMWIU7Mp' >
+                <iframe onpointerover='eventhandle_n0BpsTiUS();'></iframe>
+            </nobr>
+        </i>
+    </menu>
+</body>
diff --git a/testing/web-platform/tests/editing/crashtests/delete-after-empty-script-element.html b/testing/web-platform/tests/editing/crashtests/delete-after-empty-script-element.html
new file mode 100644
index 0000000000..c06a4af802
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/delete-after-empty-script-element.html
@@ -0,0 +1,19 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+</head>
+<body>
+A
+<script>
+addEventListener("load", () => {
+  document.documentElement.contentEditable = true;
+  getSelection().collapse(document.body.lastChild, document.body.lastChild.length);
+  document.execCommand("delete");
+});
+</script>
+<li>
+<form readonly contenteditable>
+</form>
+<script>
+</script></li></body></html>
diff --git a/testing/web-platform/tests/editing/crashtests/delete-after-justifyleft-in-closed-editable-dialog.html b/testing/web-platform/tests/editing/crashtests/delete-after-justifyleft-in-closed-editable-dialog.html
new file mode 100644
index 0000000000..185cb01ee5
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/delete-after-justifyleft-in-closed-editable-dialog.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+addEventListener("load", () => {
+  const dialog = document.querySelector("dialog");
+  dialog.showModal();
+  dialog.close();
+  document.execCommand("justifyLeft");
+  document.execCommand("delete");
+});
+</script>
+</head>
+<body><dialog contenteditable>
+</dialog></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/delete-and-justifycenter-recursively-with-mutation-event-listeners.html b/testing/web-platform/tests/editing/crashtests/delete-and-justifycenter-recursively-with-mutation-event-listeners.html
new file mode 100644
index 0000000000..ce0c7e886f
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/delete-and-justifycenter-recursively-with-mutation-event-listeners.html
@@ -0,0 +1,34 @@
+<!doctype html>
+<html class="test-wait">
+<head>
+<meta charset="utf-8">
+<script>
+try {
+  function onDOMNodeInsertedOfContentEditable() {
+    getSelection().collapse(document.querySelector("input"));
+    document.execCommand("justifyCenter");
+    document.querySelector("dl").addEventListener("DOMSubtreeModified", onDOMSubtreeModifiedOfDLElement);
+    document.querySelector("dl").appendChild(document.querySelector("style"));
+  }
+  function onDOMSubtreeModifiedOfDLElement() {
+    document.execCommand("delete");
+    document.querySelector("label").appendChild(document.querySelector("input"));
+    document.querySelector("dd[contenteditable]").addEventListener("DOMNodeInserted", onDOMNodeInsertedOfContentEditable);
+  }
+  addEventListener("load", () => {
+    onDOMNodeInsertedOfContentEditable();
+    document.documentElement.removeAttribute("class");
+  });
+} catch (ex) {
+  // maybe too many recursive exception would be thrown.
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body><label></label>
+<dl>
+<dd contenteditable>
+<style>@</style>
+<input>
+</body>
+</html>
\ No newline at end of file
diff --git a/testing/web-platform/tests/editing/crashtests/delete-at-next-to-svg-display-table-cell.html b/testing/web-platform/tests/editing/crashtests/delete-at-next-to-svg-display-table-cell.html
new file mode 100644
index 0000000000..edb38bb9df
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/delete-at-next-to-svg-display-table-cell.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+addEventListener("load", async () => {
+  document.documentElement.setAttribute("contenteditable", "true");
+  getSelection().collapse(document.body.lastChild, document.body.lastChild.length);
+  document.execCommand("delete");
+});
+</script>
+</head>
+<body><svg>
+  <svg display="table-cell">
+  </svg>
+</svg>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/delete-at-start-of-first-li-in-ol-in-video.html b/testing/web-platform/tests/editing/crashtests/delete-at-start-of-first-li-in-ol-in-video.html
new file mode 100644
index 0000000000..43baf25a86
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/delete-at-start-of-first-li-in-ol-in-video.html
@@ -0,0 +1,24 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+addEventListener("DOMContentLoaded", () => {
+  getSelection().collapse(document.querySelector("ol"), 0);
+  document.execCommand("delete");
+});
+</script>
+</head>
+<body>
+<details open contenteditable>
+<map>
+<video>
+<source></source>
+<ol>
+<li>a</li>
+</ol>
+</video>
+</map>
+</details>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/delete-at-text-following-svg.html b/testing/web-platform/tests/editing/crashtests/delete-at-text-following-svg.html
new file mode 100644
index 0000000000..cc2040a2a3
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/delete-at-text-following-svg.html
@@ -0,0 +1,41 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<style>
+mask, li {
+  float: inline-start;
+  animation-name: kf0;
+}
+@keyframes kf0 {}
+</style>
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  window.focus();
+  document.designMode = "on";
+  document.onpointerlockerror = onPointerLockErrorOrAnimationStart;
+  const mask = document.querySelector("mask");
+  mask.requestPointerLock();
+  mask.prepend(document.querySelector("table"));
+});
+function onPointerLockErrorOrAnimationStart() {
+  document.execCommand("underline");
+  document.execCommand("delete");
+  onanimationstart  = onPointerLockErrorOrAnimationStart;
+  try {
+    getSelection().setBaseAndExtent(
+      document.querySelector("li"), 0,
+      document.querySelector("thead"), 0
+    );
+  } catch (e) {}
+}
+</script>
+<body><svg>
+<mask>
+<clipPath>
+</clipPath></mask></svg><sup>
+AA
+<li>
+<br></li></sup><table>
+<thead>
+</thead></table>
diff --git a/testing/web-platform/tests/editing/crashtests/delete-content-in-no-data-object.html b/testing/web-platform/tests/editing/crashtests/delete-content-in-no-data-object.html
new file mode 100644
index 0000000000..749dba303b
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/delete-content-in-no-data-object.html
@@ -0,0 +1,31 @@
+<!doctype html>
+<html class="test-wait">
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  requestAnimationFrame(() => {
+    setTimeout(() => {
+      document.execCommand("delete");
+      document.documentElement.removeAttribute("class");
+    }, 0);
+    document.execCommand("insertImage", false, "x");
+  });
+  document.execCommand("justifyCenter");
+})
+function onError() {
+  document.querySelector("s").before("BEFORE");
+  document.designMode = "on";
+  const img = document.querySelector("img");
+  img.innerHTML = "IMG";
+  getSelection().setBaseAndExtent(document.querySelector("kbd"), 0, img, 1);
+}
+</script>
+</head>
+<body><object onerror="onError()">
+<s>
+<img>
+SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
+<kbd>
+</kbd></s></object></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/delete-from-after-empty-table-header-grouped-element.html b/testing/web-platform/tests/editing/crashtests/delete-from-after-empty-table-header-grouped-element.html
new file mode 100644
index 0000000000..e6ad4fa9e3
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/delete-from-after-empty-table-header-grouped-element.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<html>
+<head>
+<meta char="utf-8">
+<script>
+addEventListener("load", () => {
+  document.documentElement.contentEditable = true;
+  getSelection().collapse(document.querySelector("svg"), document.querySelector("svg").childNodes.length);
+  document.execCommand("delete");
+});
+</script>
+<body>
+<svg>
+  <a display="table-header-group">
+  </a>
+  </svg></body></html>
\ No newline at end of file
diff --git a/testing/web-platform/tests/editing/crashtests/delete-from-ruby-at-start-of-button.html b/testing/web-platform/tests/editing/crashtests/delete-from-ruby-at-start-of-button.html
new file mode 100644
index 0000000000..0159e52815
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/delete-from-ruby-at-start-of-button.html
@@ -0,0 +1,29 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<style>
+*:last-child {
+  white-space: pre-wrap;
+}
+</style>
+<script>
+addEventListener("DOMContentLoaded", () => {
+  getSelection().collapse(document.querySelector("ruby"));
+  document.designMode = "on";
+  document.execCommand("delete");
+});
+</script>
+</head>
+<body>
+<label contenteditable="true"></label>
+<bdi style="white-space: nowrap">
+<button>
+<kbd>
+<ruby>
+</ruby>
+</kbd>
+</button>
+</bdi>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/delete-immediately-after-changing-input-type-from-time.html b/testing/web-platform/tests/editing/crashtests/delete-immediately-after-changing-input-type-from-time.html
new file mode 100644
index 0000000000..e608b8c866
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/delete-immediately-after-changing-input-type-from-time.html
@@ -0,0 +1,23 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  const input = document.querySelector("input");
+  requestAnimationFrame(() => {
+    document.body.appendChild(document.querySelector("time"));
+    input.value = "A";
+  });
+  input.focus();
+  input.setAttribute("type", "text");
+  document.execCommand("delete");
+});
+</script>
+</head>
+<body>
+<input type="time">
+<time>
+<dir>
+<li></li></dir></time></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/delete-in-block-in-progress.html b/testing/web-platform/tests/editing/crashtests/delete-in-block-in-progress.html
new file mode 100644
index 0000000000..233b834ab0
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/delete-in-block-in-progress.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  document.querySelector("mo").appendChild(document.querySelector("dialog"));
+  getSelection().collapse(document.querySelector("template"), 0);
+  document.execCommand("delete");
+}, {once:true});
+</script>
+<body>
+<dialog>
+<template>
+</template>
+</dialog>
+<dl contenteditable>
+<li>
+<b><progress>
+<mo>a</mo>
+</progress></b>
+</li>
+</dl>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-with-focus.html b/testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-with-focus.html
new file mode 100644
index 0000000000..585cd17bb8
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-with-focus.html
@@ -0,0 +1,12 @@
+<script>
+addEventListener("DOMContentLoaded", () => {
+  document.querySelector("dd[contenteditable]").focus();
+  document.querySelector("dd[contenteditable]").addEventListener("DOMNodeRemoved", () => {
+    document.querySelector("h6").textContent = "";
+  });
+  document.execCommand("selectAll");
+  document.execCommand("delete");
+})
+</script>
+<h6>
+<dd contenteditable>
diff --git a/testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-without-focus.html b/testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-without-focus.html
new file mode 100644
index 0000000000..a45f2dad82
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-without-focus.html
@@ -0,0 +1,12 @@
+<script>
+addEventListener("DOMContentLoaded", () => {
+  document.querySelector("dd[contenteditable]").blur();
+  document.querySelector("dd[contenteditable]").addEventListener("DOMNodeRemoved", () => {
+    document.querySelector("h6").textContent = "";
+  });
+  document.execCommand("selectAll");
+  document.execCommand("delete");
+})
+</script>
+<h6>
+<dd contenteditable>
diff --git a/testing/web-platform/tests/editing/crashtests/delete-in-designMode-without-explicitly-setting-focus.html b/testing/web-platform/tests/editing/crashtests/delete-in-designMode-without-explicitly-setting-focus.html
new file mode 100644
index 0000000000..16e1808dc8
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/delete-in-designMode-without-explicitly-setting-focus.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  const dl = document.querySelector("dl");
+  dl.textContent = "�";
+  document.designMode = "on";
+  document.execCommand("delete");
+})
+</script>
+</head>
+<del>
+    <dl></dl>
+</del>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/delete-in-empty-editable-list-followed-by-non-editable-listitem.html b/testing/web-platform/tests/editing/crashtests/delete-in-empty-editable-list-followed-by-non-editable-listitem.html
new file mode 100644
index 0000000000..9e872f5ac4
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/delete-in-empty-editable-list-followed-by-non-editable-listitem.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html id="a">
+<meta charset="utf-8">
+<script id="b">
+window.onload = () => {
+  c.appendChild(document.head)
+  a.appendChild(d)
+  document.execCommand("selectAll")
+  document.execCommand("delete")
+}
+</script>
+<dl id="c" contenteditable="true">
+<dt id="d">
diff --git a/testing/web-platform/tests/editing/crashtests/designMode-document-will-be-blurred-by-focus-event-listener.html b/testing/web-platform/tests/editing/crashtests/designMode-document-will-be-blurred-by-focus-event-listener.html
new file mode 100644
index 0000000000..3cd6509c4b
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/designMode-document-will-be-blurred-by-focus-event-listener.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html class="test-wait">
+<meta charset="utf-8">
+<script>
+addEventListener("load", () => {
+  const parentDocument = document;
+  const iframe = parentDocument.querySelector("iframe");
+  iframe.contentDocument.designMode = "on";
+  iframe.contentWindow.addEventListener("focus", () => {
+    iframe.contentDocument.execCommand("insertText", false, "def");
+    iframe.parentElement.setAttribute("hidden", "hidden");
+    setTimeout(() => parentDocument.documentElement.removeAttribute("class"), 0);
+  });
+  iframe.contentWindow.focus();
+});
+</script>
+<div><iframe srcdoc="<div>abc</div>"></iframe></div>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/designMode-off-during-inserthorizontalrule.html b/testing/web-platform/tests/editing/crashtests/designMode-off-during-inserthorizontalrule.html
new file mode 100644
index 0000000000..21a6199898
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/designMode-off-during-inserthorizontalrule.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  document.designMode = "on";
+  document.addEventListener("DOMNodeRemoved", () => {
+    document.documentElement.normalize();
+    document.designMode = "off";
+  });
+  getSelection().collapse(document.querySelector("address").firstChild, 1);
+  document.execCommand("insertHorizontalRule");
+});
+</script>
+</head>
+<body>
+<address>
+A
+</address>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/designMode-on-of-lazy-loading-iframe.html b/testing/web-platform/tests/editing/crashtests/designMode-on-of-lazy-loading-iframe.html
new file mode 100644
index 0000000000..90a6c85c45
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/designMode-on-of-lazy-loading-iframe.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<style>
+*::first-letter {}
+</style>
+<script>
+addEventListener("load", () => {
+  const iframe = document.querySelector("iframe");
+  iframe.contentWindow.focus();
+  document.styleSheets[0].deleteRule(0);
+  iframe.contentWindow.document.designMode = "on";
+});
+</script>
+</head>
+<body>
+<iframe loading="lazy">
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/execCommand-at-load-with-changing-editing-host.html b/testing/web-platform/tests/editing/crashtests/execCommand-at-load-with-changing-editing-host.html
new file mode 100644
index 0000000000..ec1dd30dc0
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/execCommand-at-load-with-changing-editing-host.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html contenteditable="true">
+<head>
+<meta charset="utf-8">
+<title>Test for bug 615450 of Mozilla</title>
+<script>
+function boom()
+{
+  document.documentElement.appendChild(document.body);
+  document.documentElement.contentEditable = "false";
+  try { document.execCommand("outdent", false, null); } catch(e) { }
+  document.body.contentEditable = "true";
+  try { document.execCommand("inserthtml", false, "x"); } catch(e) { }
+}
+</script>
+</head>
+<body onload="boom();"><div style="margin-left: 40px;"><span contenteditable="true">p q r s</span> T</div></body></html>
diff --git a/testing/web-platform/tests/editing/crashtests/execCommand-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html b/testing/web-platform/tests/editing/crashtests/execCommand-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html
new file mode 100644
index 0000000000..0750dddca7
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/execCommand-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html
@@ -0,0 +1,116 @@
+<!DOCTYPE HTML>
+<html><head>
+    <meta charset="iso-8859-1">
+    <title>Testcase #3 for bug 448329 of Bugzilla</title>
+</head>
+<body>
+
+<iframe id="frame448329"></iframe>
+
+<script>
+
+function test448329(id,cmd,val) {
+
+  var elm = document.getElementById(id);
+  var doc = elm.contentDocument;
+  doc.designMode = "On";
+
+  doc.body.offsetWidth;
+  var selection = doc.defaultView.getSelection();
+
+  // Test document node
+  if (selection.rangeCount > 0) {
+    selection.removeAllRanges();
+  }
+  var range = doc.createRange();
+  range.setStart(doc, 0);
+  range.setEnd(doc, 0);
+  selection.addRange(range);
+  doc.execCommand(cmd,false,val);
+
+  // Test HTML node
+  if (selection.rangeCount > 0) {
+    selection.removeAllRanges();
+  }
+  range = doc.createRange();
+  range.setStart(doc.documentElement, 0);
+  range.setEnd(doc.documentElement, 0);
+  selection.addRange(range);
+  doc.execCommand(cmd,false,val);
+
+  // Test BODY node
+  if (selection.rangeCount > 0) {
+    selection.removeAllRanges();
+  }
+  range = doc.createRange();
+  var body = doc.documentElement.childNodes[1];
+  range.setStart(body, 0);
+  range.setEnd(body, 0);
+  selection.addRange(range);
+  doc.execCommand(cmd,false,val);
+
+  var text = doc.createTextNode("Hello Kitty");
+  body.insertBefore(text, null)
+
+  // Test TEXT node
+  if (selection.rangeCount > 0) {
+    selection.removeAllRanges();
+  }
+  range = doc.createRange();
+  range.setStart(text, 0);
+  range.setEnd(text, 1);
+  selection.addRange(range);
+  doc.execCommand(cmd,false,val);
+
+  // Test BODY[0,0] + TEXT node
+  if (selection.rangeCount > 0) {
+    selection.removeAllRanges();
+  }
+  range = doc.createRange();
+  range.setStart(body, 0);
+  range.setEnd(body, 0);
+  selection.addRange(range);
+  range = doc.createRange();
+  range.setStart(text, 0);
+  range.setEnd(text, 1);
+  selection.addRange(range);
+  doc.execCommand(cmd,false,val);
+
+  // Test BODY[0,1] + TEXT node
+  if (selection.rangeCount > 0) {
+    selection.removeAllRanges();
+  }
+  range = doc.createRange();
+  range.setStart(body, 0);
+  range.setEnd(body, 1);
+  selection.addRange(range);
+  range = doc.createRange();
+  range.setStart(text, 0);
+  range.setEnd(text, 1);
+  selection.addRange(range);
+  doc.execCommand(cmd,false,val);
+
+  // Test BODY[0,1] + TEXT node without a parent
+  if (selection.rangeCount > 0) {
+    selection.removeAllRanges();
+  }
+  range = doc.createRange();
+  range.setStart(body, 0);
+  range.setEnd(body, 1);
+  selection.addRange(range);
+  range = doc.createRange();
+  text = doc.createTextNode("Hello there"); // not in doc
+  range.setStart(text, 0);
+  range.setEnd(text, 1);
+  selection.addRange(range);
+  doc.execCommand(cmd,false,val);
+}
+
+test448329("frame448329", "backcolor", "green")
+test448329("frame448329", "hilitecolor", "green")
+
+</script>
+
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/execCommand-without-selection-ranges.html b/testing/web-platform/tests/editing/crashtests/execCommand-without-selection-ranges.html
new file mode 100644
index 0000000000..04913664e6
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/execCommand-without-selection-ranges.html
@@ -0,0 +1,65 @@
+<!doctype html>
+<head>
+<meta charset="utf-8">
+</head>
+<body>
+<script>
+for (const command of [
+  ["bold", ""],
+  ["italic", ""],
+  ["underline", ""],
+  ["strikethrough", ""],
+  ["subscript", ""],
+  ["superscript", ""],
+  ["cut", ""],
+  ["copy", ""],
+  ["paste", ""],
+  ["delete", ""],
+  ["forwarddelete", ""],
+  ["selectall", ""],
+  ["undo", ""],
+  ["redo", ""],
+  ["indent", ""],
+  ["outdent", ""],
+  ["backcolor", "#888888"],
+  ["forecolor", "#888888"],
+  ["hilitecolor", "#888888"],
+  ["fontname", "Courier"],
+  ["fontsize", "6"],
+  ["increasefontsize", ""],
+  ["decreasefontsize", ""],
+  ["inserthorizontalrule", ""],
+  ["createlink", "foo"],
+  ["insertimage", "foo"],
+  ["inserthtml", "foo"],
+  ["inserttext", "foo"],
+  ["insertparagraph", ""],
+  ["gethtml", ""],
+  ["justifyleft", ""],
+  ["justifyright", ""],
+  ["justifycenter", ""],
+  ["justifyfull", ""],
+  ["removeformat", ""],
+  ["unlink", ""],
+  ["insertorderedlist", ""],
+  ["insertunorderedlist", ""],
+  ["formatblock", "h1"],
+  ["heading", "h1"],
+  ["stylewithcss", "true"],
+  ["usecss", "true"],
+  ["contentreadonly", "true"],
+  ["readonly", "true"],
+  ["insertbronreturn", "true"],
+  ["enableobjectresizing", "true"],
+  ["enableinlinetableediting", "true"],
+]) {
+  document.body.innerHTML = "<div contenteditable>abc</div>";
+  document.querySelector("div[contenteditable]").focus();
+  getSelection().removeAllRanges();
+  try {
+    document.execCommand(command[0], false, command[1]);
+  } catch(e) {}
+}
+</script>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/format-block-selection-containing-non-editable-list.html b/testing/web-platform/tests/editing/crashtests/format-block-selection-containing-non-editable-list.html
new file mode 100644
index 0000000000..2f8f8ea5ab
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/format-block-selection-containing-non-editable-list.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script>
+      window.addEventListener('load', () => {
+        document.execCommand('selectAll', false, null)
+        document.execCommand('formatBlock', false, 'h1')
+      })
+    </script>
+</head>
+<body>
+<main contenteditable='true'>
+    <li></li>
+    <ol contenteditable='false'>
+    </ol>
+</main>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/forwarddelete-after-editable-slot-element-outside-body.html b/testing/web-platform/tests/editing/crashtests/forwarddelete-after-editable-slot-element-outside-body.html
new file mode 100644
index 0000000000..480f02ded9
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/forwarddelete-after-editable-slot-element-outside-body.html
@@ -0,0 +1,28 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  const slot = document.createElement("slot");
+  document.documentElement.appendChild(slot);
+  const anchor = document.querySelector("a[contenteditable]");
+  const selection = document.getSelection()
+  getSelection().collapse(anchor, 0);
+  getSelection().setBaseAndExtent(
+    document, 0,
+    document.documentElement, document.documentElement.childNodes.length
+  );
+  const range = selection.getRangeAt(0);
+  document.documentElement.contentEditable = true;
+  document.documentElement.contentEditable = false;
+  range.collapse(false);
+  getSelection().removeAllRanges();
+  getSelection().addRange(range);
+  document.documentElement.contentEditable = true;
+  document.execCommand("forwardDelete");
+});
+</script>
+</head><body>
+<a contenteditable></a>
+</body></html>
diff --git a/testing/web-platform/tests/editing/crashtests/forwarddelete-at-empty-text-node-in-body.html b/testing/web-platform/tests/editing/crashtests/forwarddelete-at-empty-text-node-in-body.html
new file mode 100644
index 0000000000..4fba13d5d8
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/forwarddelete-at-empty-text-node-in-body.html
@@ -0,0 +1,8 @@
+<body contenteditable=true>x   y
+<script>
+document.body.firstChild.splitText(2)  // "x " and "  y"
+                        .splitText(1)  // "x", " " and "  y"
+                        .splitText(1); // "x", "", " " and "  y"
+getSelection().collapse(document.body, 1);
+document.execCommand("forwardDelete");
+</script>
diff --git a/testing/web-platform/tests/editing/crashtests/forwarddelete-delete-after-justifyleft-indent.html b/testing/web-platform/tests/editing/crashtests/forwarddelete-delete-after-justifyleft-indent.html
new file mode 100644
index 0000000000..0b0e188732
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/forwarddelete-delete-after-justifyleft-indent.html
@@ -0,0 +1,20 @@
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  const fieldset = document.querySelector("fieldset");
+  document.documentElement.contentEditable = true;
+  fieldset.contentEditable = false;
+  document.execCommand("justifyLeft");
+  document.designMode = "on";
+  document.execCommand("indent");
+  document.execCommand("forwardDelete");
+  document.execCommand("delete");
+});
+</script>
+<acronym readonly autofocus>
+<sup>
+<fieldset>
+
+here is fieldset
+</fieldset>
+</acronym>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-with-focus.html b/testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-with-focus.html
new file mode 100644
index 0000000000..266cc4fb60
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-with-focus.html
@@ -0,0 +1,15 @@
+<script>
+addEventListener("load", () => {
+  document.querySelector("ol[contenteditable]").focus();
+  document.execCommand("selectAll");
+  const targetListItem = document.querySelector("li + li");
+  targetListItem.addEventListener("DOMSubtreeModified", () => {
+    document.execCommand("forwardDelete");
+    document.querySelector("script").appendChild(targetListItem);
+  });
+  targetListItem.setAttribute("scrolling", "auto");
+});
+</script>
+<ol contenteditable>
+<li>
+<li>a</li>
diff --git a/testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-without-focus.html b/testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-without-focus.html
new file mode 100644
index 0000000000..de10e8b8a9
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-without-focus.html
@@ -0,0 +1,15 @@
+<script>
+addEventListener("load", () => {
+  document.querySelector("ol[contenteditable]").blur();
+  document.execCommand("selectAll");
+  const targetListItem = document.querySelector("li + li");
+  targetListItem.addEventListener("DOMSubtreeModified", () => {
+    document.execCommand("forwardDelete");
+    document.querySelector("script").appendChild(targetListItem);
+  });
+  targetListItem.setAttribute("scrolling", "auto");
+});
+</script>
+<ol contenteditable>
+<li>
+<li>a</li>
diff --git a/testing/web-platform/tests/editing/crashtests/forwarddelete-in-text-in-span-in-editable-documentElement.html b/testing/web-platform/tests/editing/crashtests/forwarddelete-in-text-in-span-in-editable-documentElement.html
new file mode 100644
index 0000000000..26f2f64b81
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/forwarddelete-in-text-in-span-in-editable-documentElement.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<script>
+addEventListener("load", () => {
+  const r = document.documentElement;
+  while (r.firstChild) {
+    r.firstChild.remove();
+  }
+
+  document.documentElement.contentEditable = "true";
+  document.documentElement.appendChild(document.createElement("span"));
+  document.documentElement.firstChild.appendChild(document.createTextNode("_"));
+  document.execCommand("forwarddelete");
+});
+</script>
+<body>
diff --git a/testing/web-platform/tests/editing/crashtests/indent-in-inline-editing-host-outside-body.html b/testing/web-platform/tests/editing/crashtests/indent-in-inline-editing-host-outside-body.html
new file mode 100644
index 0000000000..d56a0fd248
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/indent-in-inline-editing-host-outside-body.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+addEventListener("load", () => {
+  const samp = document.createElement("samp");
+  samp.innerText = "ABC";
+  samp.contentEditable = true;
+  document.documentElement.appendChild(samp);
+  getSelection().selectAllChildren(samp);
+  document.execCommand("indent");
+});
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/indent-in-textarea-in-designMode-during-outdent.html b/testing/web-platform/tests/editing/crashtests/indent-in-textarea-in-designMode-during-outdent.html
new file mode 100644
index 0000000000..313c51bb5a
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/indent-in-textarea-in-designMode-during-outdent.html
@@ -0,0 +1,34 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+</head>
+<body>
+A
+<script>
+addEventListener("load", () => {
+  const textarea = document.querySelector("textarea");
+  textarea.addEventListener("focusin", onFocusIn);
+  textarea.select();
+  document.execCommand("outdent");
+});
+
+function onFocusIn() {
+  document.querySelector("marquee").onstart = () => {
+    document.designMode = "off";
+    window.find("AA");
+  };
+  document.designMode = "on";
+  document.execCommand("selectAll");
+  document.execCommand("indent");
+  document.designMode = "on";
+}
+</script>
+<fieldset>
+<textarea></textarea>
+AA
+</fieldset>
+<marquee id="b"></marquee>
+<blockquote contenteditable="true"></blockquote>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/indent-outdent-after-closing-editable-dialog-element.html b/testing/web-platform/tests/editing/crashtests/indent-outdent-after-closing-editable-dialog-element.html
new file mode 100644
index 0000000000..7f73de048d
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/indent-outdent-after-closing-editable-dialog-element.html
@@ -0,0 +1,31 @@
+<html class="reftest-wait">
+<script>
+var eventCount = 0;
+document.addEventListener("DOMContentLoaded", () => {
+  const dialog = document.querySelector("dialog");
+  const object = document.createElement("object");
+  object.addEventListener("DOMSubtreeModified", () => {
+    dialog.show();
+    dialog.focus();
+    document.execCommand("selectAll");
+    dialog.close();
+    setTimeout(() => {
+      document.execCommand("selectAll");
+      document.execCommand("strikeThrough");
+      document.execCommand("indent");
+      document.execCommand("outdent");
+      eventCount--;
+      if (!eventCount) {
+        document.documentElement.removeAttribute("class");
+      }
+    });
+    eventCount++;
+  });
+  object.setAttribute("role", "x"); // Run DOMSubtreeModified
+  object.setAttribute("role", "y"); // Run DOMSubtreeModified
+  document.execCommand("forwardDelete");
+  document.execCommand("justifyRight");
+})
+</script>
+<dialog id="a" contenteditable="true">a</dialog>
+</html>
\ No newline at end of file
diff --git a/testing/web-platform/tests/editing/crashtests/insert-image-with-joining-header-element-and-body.html b/testing/web-platform/tests/editing/crashtests/insert-image-with-joining-header-element-and-body.html
new file mode 100644
index 0000000000..cf5b2df225
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/insert-image-with-joining-header-element-and-body.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <script>
+    window.addEventListener("load", () => {
+      const heading = document.getElementById("heading")
+      const input = document.createElementNS("http://www.w3.org/1999/xhtml", "input")
+      heading.appendChild(input)
+      const selection = window.getSelection()
+      const range = new Range()
+      range.setStartBefore(input)
+      heading.contentEditable = true
+      document.execCommand("selectAll", false, null)
+      document.designMode = "on"
+      selection.addRange(range)
+      range.setEndBefore(heading)
+      range.setEndAfter(heading)
+      document.execCommand("insertImage", false, "wss://:pass@[::1]$/")
+    })
+  </script>
+</head>
+<h4 id="heading"></h4>
+<!-- COMMENT -->
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/insertAdjacentElement-with-DOMSubtreeModified.html b/testing/web-platform/tests/editing/crashtests/insertAdjacentElement-with-DOMSubtreeModified.html
new file mode 100644
index 0000000000..4b9533282d
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/insertAdjacentElement-with-DOMSubtreeModified.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<head>
+<script src="../resources/js-test.js"></script>
+<script>
+function onLoad() {
+    const x1 = document.getElementById('x1');
+    x1.addEventListener('DOMSubtreeModified', () => {
+        const x2 = document.getElementById('x2');
+        x2.contentDocument;
+    });
+    x1.setAttribute('inputmode', 'url');
+}
+function insertAdjacent() {
+    const x2 = document.getElementById('x2');
+    const x3 = document.getElementById('x3');
+    document.onreadystatechange = insertAdjacent;
+    x3.insertAdjacentElement('beforebegin', x2);
+}
+</script>
+</head>
+<body onload="onLoad()">
+<div id="x1"></div>
+<object id="x2" data="invalid-url" onerror="insertAdjacent()"></object>
+<div id="x3"></div>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/insertText-at-end-of-text-in-body.html b/testing/web-platform/tests/editing/crashtests/insertText-at-end-of-text-in-body.html
new file mode 100644
index 0000000000..763697314b
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/insertText-at-end-of-text-in-body.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+addEventListener("load", event => {
+  document.body.focus();
+  const text = document.createTextNode("x".repeat(15));
+  document.body.appendChild(text);
+  getSelection().collapse(text, text.length);
+  document.execCommand("insertText", false, "a");
+});
+</script>
+</head>
+<body contenteditable></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/insertText-nested-by-DOMSubtreeModified.html b/testing/web-platform/tests/editing/crashtests/insertText-nested-by-DOMSubtreeModified.html
new file mode 100644
index 0000000000..45b0e67ed4
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/insertText-nested-by-DOMSubtreeModified.html
@@ -0,0 +1,29 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  const output = document.querySelector("output");
+  const table = document.querySelector("table");
+  table.addEventListener("DOMSubtreeModified", () => {
+    document.execCommand("bold");
+    document.execCommand("hiliteColor", false, "white");
+    output.appendChild(table);
+    document.execCommand("forwardDelete");
+    table.setAttribute("onwebkitsourceclose", "foo()");
+    document.execCommand("insertText", false, "a");
+  });
+  document.execCommand("selectAll");
+  table.insertRow();
+});
+</script>
+</head>
+<body>
+<canvas contenteditable>
+<output>
+<table tabindex="0" autofocus></table>
+</output>
+</canvas>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-fieldset-and-everything-styled-white-space-pre.html b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-fieldset-and-everything-styled-white-space-pre.html
new file mode 100644
index 0000000000..d06157e784
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-fieldset-and-everything-styled-white-space-pre.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <style>
+        * {
+            white-space: pre
+        }
+    </style>
+    <script>
+      document.addEventListener('DOMContentLoaded', () => {
+        const quote_0 = document.getElementById('id_0')
+        const quote_1 = document.createElement('blockquote')
+        const fieldset_1 = document.createElement('fieldset')
+        quote_1.appendChild(fieldset_1)
+        document.documentElement.appendChild(quote_1)
+        const selection = self.getSelection()
+        selection.collapse(fieldset_1, 0)
+        quote_0.contentEditable = false
+        document.documentElement.contentEditable = true
+        document.execCommand('insertHorizontalRule', false, null)
+      })
+    </script>
+</head>
+<blockquote id='id_0'></blockquote>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-textarea-in-editor-and-undo-on-error-events.html b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-textarea-in-editor-and-undo-on-error-events.html
new file mode 100644
index 0000000000..204f75a89f
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-textarea-in-editor-and-undo-on-error-events.html
@@ -0,0 +1,31 @@
+<!doctype html>
+<html class="test-wait">
+<head>
+<meta charset="utf-8">
+<script>
+var count = 0;
+function onError() {
+  if (++count > 2) {
+    document.documentElement.removeAttribute("class");
+    return;
+  }
+  const object = document.getElementById("a");
+  const mi = document.getElementById("b");
+  object.data = "";
+  object.appendChild(document.getElementById("c"));
+  mi.appendChild(document.getElementById("c"));
+  getSelection().collapse(document.getElementById("c"), 0);
+  document.execCommand("undo");
+  document.execCommand("insertHorizontalRule");
+}
+</script>
+</head>
+<body>
+<textarea id="c">a</textarea>
+<dt contenteditable="true">
+<mi id="b">#</mi>
+<object id="a" onerror="onError()">
+</object>
+</dt>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-2-selection-ranges-and-one-is-outside-body.html b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-2-selection-ranges-and-one-is-outside-body.html
new file mode 100644
index 0000000000..d248c333d9
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-2-selection-ranges-and-one-is-outside-body.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+  const form = document.createElement("form");
+  const range = new Range();
+  document.documentElement.contentEditable = true;
+  document.execCommand("formatBlock", false, "h3");
+  document.documentElement.appendChild(form);
+  range.setStartBefore(form);
+  getSelection().addRange(range);
+  range.selectNode(form);
+  document.execCommand("insertHorizontalRule");
+});
+</script>
+</head>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-range-ending-in-collapsible-spaces-before-comment.html b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-range-ending-in-collapsible-spaces-before-comment.html
new file mode 100644
index 0000000000..d7224c3095
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-range-ending-in-collapsible-spaces-before-comment.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  getSelection().setBaseAndExtent(
+    document.querySelector("b"), 0,
+    document.querySelector("i").firstChild, 2
+  );
+  document.documentElement.contentEditable = true;
+  document.execCommand("insertHorizontalRule");
+});
+</script>
+</head>
+<body>
+<div>
+<b>
+</b>
+<i>X
+</i>
+<!-- COMMENT -->
+</div>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-selecting-text-in-document-element.html b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-selecting-text-in-document-element.html
new file mode 100644
index 0000000000..c46b0359e8
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-selecting-text-in-document-element.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  const text = document.createTextNode("abc");
+  document.documentElement.appendChild(text);
+  const range = new Range();
+  range.selectNodeContents(text);
+  document.documentElement.contentEditable = "true";
+  document.execCommand("insertUnorderedList");
+  getSelection().addRange(range);
+  document.execCommand("insertHorizontalRule");
+});
+</script>
+</head>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/inserthtml-after-temporarily-removing-document-element.html b/testing/web-platform/tests/editing/crashtests/inserthtml-after-temporarily-removing-document-element.html
new file mode 100644
index 0000000000..7245fe3ddc
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/inserthtml-after-temporarily-removing-document-element.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html class="test-wait">
+<head>
+<meta charset="utf-8">
+<title>Testcase for bug 716456 of Mozilla</title>
+<script>
+function boom() {
+  const div = document.querySelector("div");
+  div.contentEditable = "true";
+  div.focus();
+
+  const root = document.documentElement;
+  document.removeChild(root);
+  document.appendChild(root);
+
+  setTimeout(() => {
+    getSelection().collapse(div, 0);
+    document.execCommand("inserthtml", false, "a");
+    setTimeout(() => {
+      document.documentElement.removeAttribute("class");
+    }, 0);
+  }, 0);
+}
+</script>
+</head>
+<body onload="boom();"><div></div></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/inserthtml-in-inline-editing-host-at-load-event.html b/testing/web-platform/tests/editing/crashtests/inserthtml-in-inline-editing-host-at-load-event.html
new file mode 100644
index 0000000000..22f172856a
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/inserthtml-in-inline-editing-host-at-load-event.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+
+<body onload="try { document.execCommand('inserthtml', false, '0'); } catch(e) { }"><span id="textarea" contenteditable="true">is</span></body>
+
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/inserthtml-in-li-in-option.html b/testing/web-platform/tests/editing/crashtests/inserthtml-in-li-in-option.html
new file mode 100644
index 0000000000..c8aa9f780f
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/inserthtml-in-li-in-option.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+"use strict";
+document.addEventListener("DOMContentLoaded", () => {
+  const select = document.querySelector("select");
+  select.appendChild(document.querySelector("option"));
+  select.appendChild(document.createElement("optgroup"));
+  document.querySelector("p").appendChild(document.querySelector("li[contenteditable]"));
+  getSelection().collapse(document.querySelector("output"), 0);
+  document.execCommand("insertHTML", false, select.innerHTML);
+});
+</script>
+</head>
+<body>
+<dl>
+<select>a</select>
+<p></p>
+<option>
+<li contenteditable>
+<output>
+</output><li></option></dl></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/inserthtml-in-text-adopted-to-other-document.html b/testing/web-platform/tests/editing/crashtests/inserthtml-in-text-adopted-to-other-document.html
new file mode 100644
index 0000000000..d8234f917a
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/inserthtml-in-text-adopted-to-other-document.html
@@ -0,0 +1,52 @@
+<!DOCTYPE html>
+<html class="test-wait">
+<head>
+<script>
+function init1()
+{
+  targetIframe = document.createElementNS('http://www.w3.org/1999/xhtml', 'iframe');
+  targetIframe.srcdoc = "<html></html>";
+  targetIframe.setAttribute("style", "width: 300px; height: 200px; border: 1px dotted green;");
+  targetIframe.addEventListener("load", init2);
+  document.body.appendChild(targetIframe);
+}
+
+function init2()
+{
+  targetWindow = targetIframe.contentWindow;
+  targetDocument = targetWindow.document;
+
+  var div = document.getElementById("div");
+  textNode = div.firstChild;
+
+  targetDocument.body.appendChild(targetDocument.adoptNode(div, true));
+
+  targetDocument.designMode = 'on';
+  setTimeout(init3, 0);
+}
+
+function init3()
+{
+  var rng = targetDocument.createRange();
+  rng.setStart(textNode, 1);
+  rng.setEnd(textNode, 1);
+  targetWindow.getSelection().addRange(rng);
+
+  try {
+    targetDocument.execCommand("inserthtml", false, "<p>");
+  } catch(e) {}
+
+  document.documentElement.removeAttribute("class");
+}
+</script>
+
+</head>
+
+<body onload="init1();">
+
+<div id="div"> </div>
+
+<script>
+</script>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/inserthtml-indent-delete-when-input-element-in-editing-host-has-focus.html b/testing/web-platform/tests/editing/crashtests/inserthtml-indent-delete-when-input-element-in-editing-host-has-focus.html
new file mode 100644
index 0000000000..ff1eebe041
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/inserthtml-indent-delete-when-input-element-in-editing-host-has-focus.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<title>Test for bug 636074 of Mozilla</title>
+<script>
+function boom()
+{
+  document.getElementById("i").focus();
+  document.documentElement.contentEditable = "true";
+  document.execCommand("inserthtml", false, "<table>");
+  document.execCommand("indent", false, null);
+  document.execCommand("delete", false, null);
+}
+</script>
+</head>
+<body onload="boom();"><input id="i"></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/inserthtml-to-replace-root-list-element-in-designMode.html b/testing/web-platform/tests/editing/crashtests/inserthtml-to-replace-root-list-element-in-designMode.html
new file mode 100644
index 0000000000..c751a5bebc
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/inserthtml-to-replace-root-list-element-in-designMode.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  document.execCommand("selectAll");
+  const editingHost = document.querySelector("thead[contenteditable]");
+  editingHost.addEventListener("focus", () => {
+    editingHost.addEventListener("focusout", () => {
+      document.execCommand("italic");
+      document.execCommand("insertText", false, "A");
+      document.execCommand("insertUnorderedList");
+    });
+    document.designMode = "on";
+    document.execCommand("selectAll");
+    document.execCommand("insertHTML", false, "A");
+  });
+  editingHost.focus();
+});
+</script>
+</head>
+<body>
+<big>
+</big>
+<table>
+<thead contenteditable>
+</thead></table>
+<p>
+<object></object>
+</p>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/insertimage-with-replacing-selection-in-picture-element.html b/testing/web-platform/tests/editing/crashtests/insertimage-with-replacing-selection-in-picture-element.html
new file mode 100644
index 0000000000..aaae4c7c9f
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/insertimage-with-replacing-selection-in-picture-element.html
@@ -0,0 +1,47 @@
+<!doctype html>
+<html class="test-wait">
+<head>
+<meta charset="utf-8">
+<style>
+@keyframes keyframes0 {}
+picture {
+  animation: keyframes0 300ms alternate,alternate paused;
+}
+ruby {
+  animation: keyframes0 step-start -1.5s normal backwards paused;
+}
+</style>
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  find("AAA")
+  const header = document.querySelector("header");
+  addEventListener("animationend", () => {
+    const imgsrc =
+      "data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAGAAAABgCAYAAADimHc4AAAABGdBTUEAALGPC/xhBQAAAAlwSFlzAAAOxAAADsQBlSsOGwAAABh0RVh0U29mdHdhcmUAUGFpbnQuTkVUIHYzLjIyt5EXfQAAAU5JREFUeF7t07ENACAMxMDA/jsDBTtcY6TUlmx+zcx510MGNuKG/QYKgL9CAQqADWB8CygANoDxLaAA2ADGt4ACYAMY3wIKgA1gfAsoADaA8S2gANgAxreAAmADGN8CCoANYHwLKAA2gPEtoADYAMa3gAJgAxjfAgqADWB8CygANoDxLaAA2ADGt4ACYAMY3wIKgA1gfAsoADaA8S2gANgAxreAAmADGN8CCoANYHwLKAA2gPEtoADYAMa3gAJgAxjfAgqADWB8CygANoDxLaAA2ADGt4ACYAMY3wIKgA1gfAsoADaA8S2gANgAxreAAmADGN8CCoANYHwLKAA2gPEtoADYAMa3gAJgAxjfAgqADWB8CygANoDxLaAA2ADGt4ACYAMY3wIKgA1gfAsoADaA8S2gANgAxreAAmADGN8CCoANYHwLKAA2gPEtAAe4i54BvwLfXFAAAAAASUVORK5CYII=";
+    function doIt() {
+      getSelection().extend(header, 0);
+      document.querySelector("figure").insertAdjacentElement("beforeend", header);
+      document.execCommand("insertImage", false, imgsrc);
+    }
+    doIt();
+    doIt();
+    doIt();
+    document.documentElement.removeAttribute("class");
+  }, {once: true});
+  document.designMode = "on";
+}, {once:true});
+</script>
+</head>
+<body>
+<picture autocapitalize="sentences">
+<figure>
+<figcaption>
+</figure>
+<ruby contenteditable="true">
+AAA
+<header>
+</header>
+</ruby>
+</picture>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/insertlinebreak-around-comment-node.html b/testing/web-platform/tests/editing/crashtests/insertlinebreak-around-comment-node.html
new file mode 100644
index 0000000000..dc2d5e2bd4
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/insertlinebreak-around-comment-node.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  const element_0 = document.createElement("s");
+  const element_1 = document.createElement("a");
+  const element_2 = document.createElement("l");
+  element_2.setAttribute("contenteditable", "true");
+  element_1.appendChild(element_2);
+  element_0.appendChild(element_1);
+  document.documentElement.appendChild(element_0);
+  document.designMode = "on";
+  document.execCommand("insertLineBreak");
+});
+</script>
+</head>
+<body><!-- COMMENT --></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/insertlinebreak-in-map-element-editing-host.html b/testing/web-platform/tests/editing/crashtests/insertlinebreak-in-map-element-editing-host.html
new file mode 100644
index 0000000000..c141f89c4e
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/insertlinebreak-in-map-element-editing-host.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<script>
+  document.addEventListener("DOMContentLoaded", () => {
+    document.getElementById("id_0").contentEditable = false;
+    document.querySelector("[contenteditable]").focus();
+    document.execCommand("insertLineBreak");
+  })
+</script>
+<pre>
+<ins id="id_0">
+<map contenteditable>
\ No newline at end of file
diff --git a/testing/web-platform/tests/editing/crashtests/insertorderedlist-in-focused-inline-editing-host.html b/testing/web-platform/tests/editing/crashtests/insertorderedlist-in-focused-inline-editing-host.html
new file mode 100644
index 0000000000..73869af3b5
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/insertorderedlist-in-focused-inline-editing-host.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html class="test-wait">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  const inlineEditingHost = document.getElementById("s");
+  inlineEditingHost.addEventListener("focus", () => {
+    try {
+      document.execCommand("insertorderedlist");
+    } catch(e) { }
+    document.documentElement.removeAttribute("class");
+  }, {once: true});
+  inlineEditingHost.focus();
+}
+
+</script>
+</head>
+
+<body onload="boom();"><span id="s" contenteditable="true">One<div></div></span><marquee></marquee></body>
+
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/insertorderedlist-in-text-adopted-to-other-document.html b/testing/web-platform/tests/editing/crashtests/insertorderedlist-in-text-adopted-to-other-document.html
new file mode 100644
index 0000000000..e505e5bf2f
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/insertorderedlist-in-text-adopted-to-other-document.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<html class="test-wait">
+<head>
+<script>
+function init1()
+{
+  // Create an html:iframe in HTML mode (so designMode can be used 320092)
+  targetIframe = document.createElementNS('http://www.w3.org/1999/xhtml', 'iframe');
+  targetIframe.srcdoc = "<html></html>";
+  targetIframe.setAttribute("style", "width: 700px; height: 500px; border: 1px dotted green;");
+  targetIframe.addEventListener("load", init2);
+  document.body.appendChild(targetIframe);
+}
+
+function init2()
+{
+  targetWindow = targetIframe.contentWindow;
+  targetDocument = targetWindow.document;
+
+  p = document.getElementById("p");
+  pText = p.firstChild;
+
+  targetDocument.body.appendChild(targetDocument.adoptNode(p, true));
+
+  targetDocument.designMode = 'on';
+
+  setTimeout(boom, 0);
+}
+
+function boom()
+{
+  var rng = targetDocument.createRange();
+  rng.setStart(pText, 3);
+  rng.setEnd(pText, 3);
+
+  targetWindow.getSelection().addRange(rng);
+
+  targetDocument.execCommand("insertorderedlist", false, null);
+
+  document.documentElement.removeAttribute("class")
+}
+</script>
+</head>
+
+<body onload="init1();">
+<p id="p">word word</p>
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/insertparagraph-from-DOMNodeInserted-caused-by-insertorderedlist.html b/testing/web-platform/tests/editing/crashtests/insertparagraph-from-DOMNodeInserted-caused-by-insertorderedlist.html
new file mode 100644
index 0000000000..fa322420cb
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/insertparagraph-from-DOMNodeInserted-caused-by-insertorderedlist.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.addEventListener("DOMNodeInserted", x);
+
+  function x()
+  {
+    document.removeEventListener("DOMNodeInserted", x);
+    document.execCommand("insertParagraph", false, "");
+  }
+
+  document.execCommand("insertorderedlist", false, "");
+}
+
+</script>
+</head>
+
+<body contenteditable="true" onload="boom()"></body>
+
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/insertparagraph-in-listitem-in-svg-followed-by-collapsible-spaces.html b/testing/web-platform/tests/editing/crashtests/insertparagraph-in-listitem-in-svg-followed-by-collapsible-spaces.html
new file mode 100644
index 0000000000..f5f981965b
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/insertparagraph-in-listitem-in-svg-followed-by-collapsible-spaces.html
@@ -0,0 +1,28 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+addEventListener("load", () => {
+  document.querySelector("svg").insertAdjacentText("afterend", `\n${" ".repeat(336860180)}`);
+
+  document.designMode = "on";
+  getSelection().selectAllChildren(document.querySelector("input"));
+
+  document.querySelector("li").appendChild(document.querySelector("p"));
+  document.execCommand("outdent");
+  document.execCommand("insertOrderedList");
+  document.execCommand("insertParagraph");
+});
+</script>
+</head>
+<body>
+<svg>
+  <foreignObject>
+    <li></li>
+/&gt;
+  </foreignObject></svg><p>
+  <input>
+</p>
+<title>This test takes long time due to the long white-spaces are required</title>
+</body></html>
diff --git a/testing/web-platform/tests/editing/crashtests/insertparagraph-in-map-element-editing-host.html b/testing/web-platform/tests/editing/crashtests/insertparagraph-in-map-element-editing-host.html
new file mode 100644
index 0000000000..e05b36907e
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/insertparagraph-in-map-element-editing-host.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<script>
+  document.addEventListener("DOMContentLoaded", () => {
+    document.getElementById("id_0").contentEditable = false;
+    document.querySelector("[contenteditable]").focus();
+    document.execCommand("insertParagraph");
+  })
+</script>
+<pre>
+<ins id="id_0">
+<map contenteditable>
\ No newline at end of file
diff --git a/testing/web-platform/tests/editing/crashtests/inserttext-at-start-with-different-style.html b/testing/web-platform/tests/editing/crashtests/inserttext-at-start-with-different-style.html
new file mode 100644
index 0000000000..ddd19aafd4
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/inserttext-at-start-with-different-style.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<meta charset="utf-8">
+<head>
+<script>
+function go() {
+  a.show();
+  document.execCommand("bold", false);
+  b.style.setProperty("font", "0px/43%");
+  document.execCommand("insertText", false, "a");
+}
+</script>
+</head>
+<body onload=go()>
+<ul contenteditable="true">
+<li id="b" style="font-weight: bolder">a</li>
+<dialog id="a" tabindex="0">a</dialog>
+</ul>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/inserttext-with-clearing-subscript.html b/testing/web-platform/tests/editing/crashtests/inserttext-with-clearing-subscript.html
new file mode 100644
index 0000000000..9c27a7ed53
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/inserttext-with-clearing-subscript.html
@@ -0,0 +1,31 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  getSelection().collapse(document.querySelector("code[contenteditable]").firstChild, 0);
+  window.top.find("A");
+  document.querySelector("table").insertRow(1);
+  document.querySelector("table").insertRow(1);
+  document.execCommand("subscript");
+  document.execCommand("foreColor", false, "currentColor");
+  document.execCommand("insertHTML", false, document.querySelector("h5").outerHTML);
+  document.execCommand("subscript");
+  document.execCommand("foreColor", false, "currentColor");
+  document.execCommand("insertHTML", false, document.querySelector("h5").outerHTML);
+  document.execCommand("insertText", false, "A");
+});
+</script>
+</head>
+<body>
+<table>
+<tr>
+<td>
+<code contenteditable>
+A
+<h5>
+</h5>
+</code>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-inline-editing-host.html b/testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-inline-editing-host.html
new file mode 100644
index 0000000000..74b0993322
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-inline-editing-host.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<title>Test for bug 615015 of Mozilla</title>
+<script>
+function boom()
+{
+  document.getElementById("j").focus();
+  try {
+    document.execCommand("insertunorderedlist", false, null);
+  } catch(e) { }
+}
+</script>
+</head>
+<body onload="boom();"><span><span contenteditable id="j"></span>T</span></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-table-editing-host.html b/testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-table-editing-host.html
new file mode 100644
index 0000000000..19cc205b91
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-table-editing-host.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var table = document.createElement("table");
+  document.body.appendChild(table);
+  table.contentEditable = "true";
+  table.focus();
+  try {
+    // This will throw, since it's attempting to inject a list inside a table
+    document.execCommand("insertunorderedlist", false, null);
+  } catch (e) {}
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/justifycenter-around-textarea.html b/testing/web-platform/tests/editing/crashtests/justifycenter-around-textarea.html
new file mode 100644
index 0000000000..71d24f37b4
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/justifycenter-around-textarea.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<script>
+function go() {
+  a.replaceWith(undefined)
+  window.getSelection().modify("move", "right", "word")
+  document.execCommand("justifyCenter", false)
+}
+</script>
+<div contenteditable="true">a</div>
+<textarea>23</textarea>
+<li dir="RTL">
+<strong id="a">
+<svg onload="go()">
diff --git a/testing/web-platform/tests/editing/crashtests/justifycenter-then-delete-selection-on-DOMSubtreeModified.html b/testing/web-platform/tests/editing/crashtests/justifycenter-then-delete-selection-on-DOMSubtreeModified.html
new file mode 100644
index 0000000000..1ee9ac35cb
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/justifycenter-then-delete-selection-on-DOMSubtreeModified.html
@@ -0,0 +1,24 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  document.execCommand("selectAll");
+  document.querySelector("li").addEventListener("DOMSubtreeModified", () => {
+    document.designMode = "on";
+    document.execCommand("justifyCenter");
+    getSelection().deleteFromDocument();
+  });
+  document.querySelector("li").type = "1";
+});
+</script>
+</head>
+<body>
+<li>
+  <h3 align="right">
+    <option contenteditable="true"></option>
+  </h3>
+</li>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/justifyfull-selection-containing-non-editable-div-and-everything-styled-white-space-break-space.html b/testing/web-platform/tests/editing/crashtests/justifyfull-selection-containing-non-editable-div-and-everything-styled-white-space-break-space.html
new file mode 100644
index 0000000000..cf199fa087
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/justifyfull-selection-containing-non-editable-div-and-everything-styled-white-space-break-space.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <style>
+        * {
+            white-space: break-spaces ! important;
+        }
+    </style>
+    <script>
+      window.addEventListener('load', () => {
+        document.documentElement.contentEditable = true
+        document.execCommand('selectAll', false, null)
+        document.execCommand('justifyFull', false, null)
+      })
+    </script>
+</head>
+<div contenteditable='false'></div>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/loading-different-page-in-iframe-while-iframe-sets-spellcheck-attr-from-load.html b/testing/web-platform/tests/editing/crashtests/loading-different-page-in-iframe-while-iframe-sets-spellcheck-attr-from-load.html
new file mode 100644
index 0000000000..afddac34e1
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/loading-different-page-in-iframe-while-iframe-sets-spellcheck-attr-from-load.html
@@ -0,0 +1,13 @@
+<html>
+<head>
+<script>
+function crash() {
+  document.querySelector("iframe").onload = null;
+  document.querySelector("iframe").srcdoc = "2nd page";
+}
+</script>
+</head>
+<body onload="crash()">
+  <iframe srcdoc="<html><body onload=$quot;document.body.setAttribute('spellcheck', true);$quot;></body></html>"></iframe>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/make-editable-div-inline-and-set-contenteditable-of-input-to-false.html b/testing/web-platform/tests/editing/crashtests/make-editable-div-inline-and-set-contenteditable-of-input-to-false.html
new file mode 100644
index 0000000000..1743a2641d
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/make-editable-div-inline-and-set-contenteditable-of-input-to-false.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html class="test-wait">
+<head>
+<meta charset="utf-8">
+<title>Testcase for bug 650572 of Mozilla</title>
+<script>
+function boom()
+{
+  document.documentElement.offsetHeight;
+  document.body.focus();
+  document.querySelector("div").style.display = "inline";
+  document.querySelector("input").contentEditable = "false";
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body contenteditable="true" onload="setTimeout(boom, 200);"><div><input></div></body>
+</html>
+
diff --git a/testing/web-platform/tests/editing/crashtests/make-parent-element-editable-after-making-focused-editing-host-non-editable.html b/testing/web-platform/tests/editing/crashtests/make-parent-element-editable-after-making-focused-editing-host-non-editable.html
new file mode 100644
index 0000000000..d624d7d3b9
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/make-parent-element-editable-after-making-focused-editing-host-non-editable.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script>
+function boom()
+{
+  document.getElementById("div").contentEditable = "true";
+  document.getElementById("div").focus();
+  document.getElementById("div").contentEditable = "false";
+
+  document.getElementById("table").contentEditable = "true";
+}
+</script>
+</head>
+
+<body onload="boom();">
+
+<table id="table"><td></td></table><div id="div"></div>
+
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/move-editing-host-to-subdocument-when-textarea-has-focus.html b/testing/web-platform/tests/editing/crashtests/move-editing-host-to-subdocument-when-textarea-has-focus.html
new file mode 100644
index 0000000000..b7d2e2f902
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/move-editing-host-to-subdocument-when-textarea-has-focus.html
@@ -0,0 +1,15 @@
+<script>
+addEventListener("DOMContentLoaded", () => {
+  document.querySelector("iframe").contentDocument.body.appendChild(
+    document.querySelector("span")
+  );
+  document.documentElement.style.display = "none";
+})
+</script>
+<hgroup>
+<audio controls>
+</audio>
+<iframe></iframe>
+<span contenteditable></span>
+</hgroup>
+<textarea autofocus>
diff --git a/testing/web-platform/tests/editing/crashtests/move-first-element-from-editinghost-to-outside-on-input-of-embolden.html b/testing/web-platform/tests/editing/crashtests/move-first-element-from-editinghost-to-outside-on-input-of-embolden.html
new file mode 100644
index 0000000000..6bb87c2810
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/move-first-element-from-editinghost-to-outside-on-input-of-embolden.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+addEventListener("load", () => {
+  document.querySelector("ol").addEventListener("input", () => {
+    const inlineEditingHost = document.querySelector("span[contenteditable]");
+    const iter = document.createNodeIterator(inlineEditingHost, NodeFilter.SHOW_ELEMENT);
+    iter.nextNode().before(inlineEditingHost);
+  });
+  document.execCommand("selectAll");
+  document.execCommand("bold");
+});
+</script>
+</head>
+<body>
+<ol>
+<span contenteditable>
+<h6></h6>
+</span></ol></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/move-legend-followed-by-textarea-into-orphan-div.html b/testing/web-platform/tests/editing/crashtests/move-legend-followed-by-textarea-into-orphan-div.html
new file mode 100644
index 0000000000..462ff37fd6
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/move-legend-followed-by-textarea-into-orphan-div.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<title>Testcase for bug 667321 of Mozilla</title>
+<script>
+function boom()
+{
+  document.body.style.float = "left";
+  document.createElement("div").appendChild(document.querySelector("legend"));
+}
+</script>
+</head>
+<body onload="boom();"><fieldset><legend></legend><textarea></textarea></fieldset></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/mozilla-bug-1851730.html b/testing/web-platform/tests/editing/crashtests/mozilla-bug-1851730.html
new file mode 100644
index 0000000000..ee11f76792
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/mozilla-bug-1851730.html
@@ -0,0 +1,11 @@
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  document.execCommand("selectAll", false)
+  a.wrap = "hard"
+  a.value = "A"
+  b.style.cssFloat = "left"
+})
+</script>
+<textarea id="a" autofocus="autofocus">&quot;</textarea>
+<font id="b">
+<pre>
diff --git a/testing/web-platform/tests/editing/crashtests/multiple-execCommand-calls-after-interting-long-text.html b/testing/web-platform/tests/editing/crashtests/multiple-execCommand-calls-after-interting-long-text.html
new file mode 100644
index 0000000000..32d0e38248
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/multiple-execCommand-calls-after-interting-long-text.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<title>Testcase for bug 682650 of Mozilla</title>
+<script>
+function boom() {
+  document.documentElement.contentEditable = "true";
+  document.execCommand("inserthtml", false, "<button><\/button>");
+  document.execCommand("inserthtml", false, "i".repeat(34646));
+  document.execCommand("contentReadOnly", false, null);
+  document.execCommand("removeformat", false, null);
+  document.execCommand("hilitecolor", false, "red");
+  document.execCommand("inserthtml", false, "a");
+  document.execCommand("delete", false, null);
+}
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/non-root-editable-html-element.html b/testing/web-platform/tests/editing/crashtests/non-root-editable-html-element.html
new file mode 100644
index 0000000000..2e4c02b0e1
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/non-root-editable-html-element.html
@@ -0,0 +1,7 @@
+<span>
+<script contenteditable="true"></script>
+<blockquote>
+<input>
+<code style="display: table-row;">
+<html contenteditable="true">
+</blockquote>
diff --git a/testing/web-platform/tests/editing/crashtests/normalize_document_at_DOMSubtreeModified_during_insertparagraph.html b/testing/web-platform/tests/editing/crashtests/normalize_document_at_DOMSubtreeModified_during_insertparagraph.html
new file mode 100644
index 0000000000..a8cbaf7217
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/normalize_document_at_DOMSubtreeModified_during_insertparagraph.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+addEventListener("load", () => {
+  document.documentElement.innerHTML = "<main>\n>";
+  document.addEventListener("DOMSubtreeModified", () => {
+    document.normalize();
+  }, {capture: true});
+  document.designMode = "on"
+  document.execCommand("insertParagraph");
+});
+</script>
+</head>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/outdent-across-svg-boundary.html b/testing/web-platform/tests/editing/crashtests/outdent-across-svg-boundary.html
new file mode 100644
index 0000000000..f652a2e237
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/outdent-across-svg-boundary.html
@@ -0,0 +1,38 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="test-wait">
+<head>
+<script>
+function init()
+{
+  var targetWindow = window.frames[0];
+  var targetDocument = targetWindow.document;
+  var rootish = document.getElementById('rootish');
+
+  targetDocument.body.appendChild(targetDocument.adoptNode(rootish));
+  targetDocument.designMode = 'on';
+
+  targetWindow.getSelection().removeAllRanges();
+
+  var r = targetDocument.createRange();
+  r.setStart(targetDocument.getElementById("start"), 0);
+  r.setEnd(targetDocument.getElementById("endparent").firstChild, 0);
+  targetWindow.getSelection().addRange(r);
+
+  targetDocument.execCommand('outdent', false, null);
+  document.documentElement.removeAttribute("class");
+}
+</script>
+
+</head>
+
+<body onload="setTimeout(init, 300);">
+
+<iframe srcdoc="" style="width: 95%; height: 500px;"></iframe>
+
+<div id="rootish">
+  <div id="start"></div>
+  <p>Huh</p>
+  <svg xmlns="http://www.w3.org/2000/svg" id="endparent"> </svg>
+</div>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/outdent-editing-host-containing-combining-diacritical-mark.html b/testing/web-platform/tests/editing/crashtests/outdent-editing-host-containing-combining-diacritical-mark.html
new file mode 100644
index 0000000000..0ed71f789b
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/outdent-editing-host-containing-combining-diacritical-mark.html
@@ -0,0 +1,16 @@
+<html class="test-wait">
+<head>
+<meta charset="utf-8">
+<title>Test for bug 499844 of Mozilla</title>
+<script>
+function boom()
+{
+  document.body.contentEditable = "true";
+  getSelection().collapse(document.body.firstChild, 0);
+  document.execCommand("outdent");
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body style="word-spacing: 3px;" onload="boom();"> &#x0301;</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/outdent-in-empty-body-editing-host.html b/testing/web-platform/tests/editing/crashtests/outdent-in-empty-body-editing-host.html
new file mode 100644
index 0000000000..f68e46bc53
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/outdent-in-empty-body-editing-host.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+<body style="margin: initial;"
+      contenteditable="true"
+      onload="document.execCommand('outdent', false, null);"></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/outdent-in-meter-indented-by-legend-in-css-mode.html b/testing/web-platform/tests/editing/crashtests/outdent-in-meter-indented-by-legend-in-css-mode.html
new file mode 100644
index 0000000000..af20ea8128
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/outdent-in-meter-indented-by-legend-in-css-mode.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+addEventListener("load", () => {
+  document.execCommand("styleWithCSS", false, "true");
+  document.getSelection().collapse(document.querySelector("label"), 0);
+  document.execCommand("outdent");
+});
+</script>
+</head>
+<body>
+<li contenteditable>
+<legend style="margin-right: 43%">
+<meter>
+<mi dir="rtl">8</mi>
+<label>
+<dir></dir>
+</label>
+</meter>
+</legend>
+</li>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/outdent-indent-inserthorizontalrule-on-selectionchange.html b/testing/web-platform/tests/editing/crashtests/outdent-indent-inserthorizontalrule-on-selectionchange.html
new file mode 100644
index 0000000000..800d9d1969
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/outdent-indent-inserthorizontalrule-on-selectionchange.html
@@ -0,0 +1,23 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+var count = 0;
+document.addEventListener("DOMContentLoaded", () => {
+  document.onselectionchange = () => {
+    document.execCommand("outdent");
+    document.execCommand("indent");
+    document.execCommand("insertHorizontalRule");
+    if (count++ == 10) {
+      document.onselectionchange = null;
+    }
+  };
+  find("A");
+});
+</script>
+</head>
+<body><isindex contenteditable>
+A
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html b/testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html
new file mode 100644
index 0000000000..6cf2524a54
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html
@@ -0,0 +1,73 @@
+<!DOCTYPE HTML>
+<html><head>
+    <meta charset="iso-8859-1">
+    <title>Testcase for bug 448329 of Mozilla</title>
+</head>
+<body>
+
+<iframe id="frame448329"></iframe>
+
+<script>
+
+function test448329(id,cmd) {
+  var elm = document.getElementById(id);
+  var doc = elm.contentDocument;
+  doc.designMode = "On";
+
+  doc.body.offsetWidth;
+  var selection = doc.defaultView.getSelection();
+
+  // Test document node
+  if (selection.rangeCount > 0) {
+    selection.removeAllRanges();
+  }
+  var range = doc.createRange();
+  range.setStart(doc, 0);
+  range.setEnd(doc, 0);
+  selection.addRange(range);
+  doc.queryCommandIndeterm(cmd);
+
+  // Test HTML node
+  if (selection.rangeCount > 0) {
+    selection.removeAllRanges();
+  }
+  range = doc.createRange();
+  range.setStart(doc.documentElement, 0);
+  range.setEnd(doc.documentElement, 0);
+  selection.addRange(range);
+  doc.queryCommandIndeterm(cmd);
+
+  // Test BODY node
+  if (selection.rangeCount > 0) {
+    selection.removeAllRanges();
+  }
+  range = doc.createRange();
+  var body = doc.documentElement.childNodes[1];
+  range.setStart(body, 0);
+  range.setEnd(body, 0);
+  selection.addRange(range);
+  doc.queryCommandIndeterm(cmd);
+
+  var text = doc.createTextNode("Hello there");
+  body.insertBefore(text, null)
+
+  // Test TEXT node
+  if (selection.rangeCount > 0) {
+    selection.removeAllRanges();
+  }
+  range = doc.createRange();
+  range.setStart(text, 0);
+  range.setEnd(text, 1);
+  selection.addRange(range);
+  doc.queryCommandIndeterm(cmd);
+
+}
+
+test448329("frame448329", "backcolor")
+test448329("frame448329", "hilitecolor")
+
+</script>
+
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-in-empty-iframe-in-designMode-from-load.html b/testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-in-empty-iframe-in-designMode-from-load.html
new file mode 100644
index 0000000000..74d80e19b3
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-in-empty-iframe-in-designMode-from-load.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+  <title>Testcase for bug 448329 of Mozilla</title>
+<script>
+function go() {
+  test("myFrame", "backcolor");
+}
+function test(id,cmd) {
+  var doc = document.getElementById(id).contentDocument;
+  doc.designMode = "On";
+
+  var selection = doc.defaultView.getSelection();
+  selection.removeAllRanges();
+  selection.addRange(doc.createRange());
+
+  doc.queryCommandIndeterm(cmd);
+}
+</script>
+</head>
+<body onload="go()"><iframe id="myFrame"></iframe></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/queryCommandState-backcolor-after-removing-html-element-in-designMode-from-load.html b/testing/web-platform/tests/editing/crashtests/queryCommandState-backcolor-after-removing-html-element-in-designMode-from-load.html
new file mode 100644
index 0000000000..1c8fe5db9b
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/queryCommandState-backcolor-after-removing-html-element-in-designMode-from-load.html
@@ -0,0 +1,8 @@
+<html>
+<BODY onload="
+document.designMode='on';
+document.removeChild(document.firstChild);
+document.queryCommandState('BackColor');
+">
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/queryCommandValue-backcolor-after-replacing-html-element-with-new-one-in-designMode-from-load.html b/testing/web-platform/tests/editing/crashtests/queryCommandValue-backcolor-after-replacing-html-element-with-new-one-in-designMode-from-load.html
new file mode 100644
index 0000000000..d14422c931
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/queryCommandValue-backcolor-after-replacing-html-element-with-new-one-in-designMode-from-load.html
@@ -0,0 +1,8 @@
+<html>
+<BODY onload="
+document.designMode='on';
+document.replaceChild(document.createElement('HTML'), document.firstChild);
+document.queryCommandValue('backcolor');
+">
+</body>
+</html>
\ No newline at end of file
diff --git a/testing/web-platform/tests/editing/crashtests/remove-document-element-of-iframe-having-style-content.html b/testing/web-platform/tests/editing/crashtests/remove-document-element-of-iframe-having-style-content.html
new file mode 100644
index 0000000000..b032311fa7
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/remove-document-element-of-iframe-having-style-content.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<title>Testcase for bug 643706 of Mozilla</title>
+<script>
+function boom() {
+  const iframe = document.querySelector("iframe");
+  const win = iframe.contentWindow;
+  win.document.designMode = 'on';
+  iframe.style.content = "'m'";
+  win.document.removeChild(win.document.documentElement)
+}
+</script>
+</head>
+<body onload="boom();"><iframe srcdoc=""></iframe></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/remove-editing-host-during-forwarddelete.html b/testing/web-platform/tests/editing/crashtests/remove-editing-host-during-forwarddelete.html
new file mode 100644
index 0000000000..6013361ccb
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/remove-editing-host-during-forwarddelete.html
@@ -0,0 +1,65 @@
+<!doctype html>
+<html class="test-wait">
+<head>
+<meta charset="utf-8">
+<style>
+dir {
+  animation: kf, 0s infinite paused;
+}
+svg {
+  animation-name: kf;
+}
+@keyframes kf {}
+</style>
+<script>
+let dir;
+// animationend for <svg> and <dir> may be fired before "DOMContentLoaded".
+// Therefore, let's start to listen them immediately.
+const waitForAnimationEnd = new Promise(resolve => {
+  let count = 0;
+  function onAnimationEnd() {
+    window.find("AAAAAAAAAA");
+    document.execCommand("forwardDelete");
+    count++;
+    function getRemainingEventCount(event) {
+      if (count >= 2) {
+        return 0;
+      }
+      if (event.target.tagName == "DIR") {
+        return 0;
+      }
+      // If `animationend` is delayed and `<dir>` has already been removed,
+      // `animationend` for it is never fired anymore.
+      return dir && !dir.isConnected ? 0 : 1;
+    }
+    if (!getRemainingEventCount()) {
+      window.removeEventListener("animationend", onAnimationEnd);
+      resolve();
+    }
+  }
+  window.addEventListener("animationend", onAnimationEnd);
+});
+
+document.addEventListener("DOMContentLoaded", async () => {
+  dir = document.querySelector("dir");
+  window.find("A");
+  document.execCommand("insertHTML", false, "AAAAAAAAAAAAAAAA");
+  dir.addEventListener("DOMNodeRemoved", event => {
+    dir.remove();
+  });
+  window.find("A");
+  document.execCommand("delete");
+  await waitForAnimationEnd;
+  document.documentElement.removeAttribute("class");
+});
+</script>
+</head>
+<body>
+<svg>
+<s></s>
+<dir contenteditable>
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+</dir>
+</svg>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/remove-editing-host-on-DOMNodeInserted-at-indent.html b/testing/web-platform/tests/editing/crashtests/remove-editing-host-on-DOMNodeInserted-at-indent.html
new file mode 100644
index 0000000000..22e8fd0713
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/remove-editing-host-on-DOMNodeInserted-at-indent.html
@@ -0,0 +1,24 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  const editingHost = document.querySelector("h6[contenteditable]");
+  document.querySelector("wbr").addEventListener(
+    "DOMNodeInserted",
+    () => editingHost.remove()
+  );
+  window.find("A");
+  document.execCommand("indent");
+})
+</script>
+</head>
+<body>
+<h6 contenteditable>
+<time>
+<wbr>
+<main></main>
+A
+</time></h6></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/remove-editing-host-which-is-selected.html b/testing/web-platform/tests/editing/crashtests/remove-editing-host-which-is-selected.html
new file mode 100644
index 0000000000..06ee6dc505
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/remove-editing-host-which-is-selected.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<script>
+window.onload = () => {
+  let s = window.getSelection()
+  let r = document.createRange()
+  r.selectNode(document.getElementById('b'))
+  s.addRange(r)
+  r = document.createRange()
+  r.selectNode(document.getElementById('a'))
+  s.addRange(r)
+  document.documentElement.innerHTML = ''
+}
+</script>
+<body id='a' contenteditable='true'>
+<canvas tabindex='0'>
+<audio id='b'>
diff --git a/testing/web-platform/tests/editing/crashtests/remove-iframe-for-designMode.html b/testing/web-platform/tests/editing/crashtests/remove-iframe-for-designMode.html
new file mode 100644
index 0000000000..609a9ca542
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/remove-iframe-for-designMode.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<title>Test for bug 612565 of Mozilla</title>
+</head>
+  <body>
+    <iframe></iframe>
+  </body>
+  <script>
+    onload = function() {
+      var i = document.querySelector("iframe");
+      var doc = i.contentDocument;
+      doc.body.appendChild(doc.createTextNode("foo"));
+      doc.designMode = "on";
+      while (doc.body.firstChild) {
+        doc.body.firstChild.remove();
+      }
+    };
+  </script>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/remove-parent-element-during-inserthtml.html b/testing/web-platform/tests/editing/crashtests/remove-parent-element-during-inserthtml.html
new file mode 100644
index 0000000000..3a0cf1c957
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/remove-parent-element-during-inserthtml.html
@@ -0,0 +1,24 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  document.onselectionchange = () => {
+    document.execCommand("insertHTML", false, "a")
+    document.designMode = "on"
+  };
+  window.find("a");
+  document.querySelector("dl[contenteditable] > dd").addEventListener("DOMNodeRemoved", () => {
+    document.querySelector("dl[contenteditable]").remove();
+  });
+});
+</script>
+</head>
+<body>
+<dl contenteditable>
+<dd></dd>
+a
+</dl>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/remove-right-block-during-joining-with-parent-left-block.html b/testing/web-platform/tests/editing/crashtests/remove-right-block-during-joining-with-parent-left-block.html
new file mode 100644
index 0000000000..29ee228fea
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/remove-right-block-during-joining-with-parent-left-block.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<title>Test removing right block while joining it and parent left block</title>
+<script>
+addEventListener("load", () => {
+  const editingHosts = document.querySelectorAll("div[contenteditable]");
+  for (const editingHost of editingHosts) {
+    editingHost.focus();
+    const rightChildBlock = editingHost.querySelector("div > div > div");
+    getSelection().collapse(rightChildBlock.firstChild.firstChild, 0);
+    editingHost.addEventListener("DOMSubtreeModified", () => {
+      document.body.appendChild(rightChildBlock);
+    });
+    document.execCommand("delete");
+  }
+});
+</script>
+</head>
+<body>
+  <div contenteditable>
+    <div>parent<div><b>child</b></div>parent</div>
+  </div>
+  <div contenteditable>
+    <div>parent<div><b>child<br>2nd line</b></div>parent</div>
+  </div>
+  <div contenteditable style="white-space:pre">
+    <div>parent<div>child
+2nd line</div>parent</div>
+  </div>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/removeformat-from-DOMNodeRemoved.html b/testing/web-platform/tests/editing/crashtests/removeformat-from-DOMNodeRemoved.html
new file mode 100644
index 0000000000..3f78f99436
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/removeformat-from-DOMNodeRemoved.html
@@ -0,0 +1,29 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  window.find("a");
+  document.addEventListener("DOMNodeRemoved", () => {
+    try {
+      document.getElementById("target").normalize();
+      document.execCommand("removeFormat");
+    } catch (e) {
+    }
+  });
+  document.adoptNode(document.querySelector("datalist"));
+});
+</script>
+</head>
+<body>
+<kbd>
+<datalist>
+</kbd>
+<figcaption contenteditable>
+<font id="target">
+a
+</font>
+</figcaption>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/removeformat-in-number-input-immediately-after-type-change-and-stepUp.html b/testing/web-platform/tests/editing/crashtests/removeformat-in-number-input-immediately-after-type-change-and-stepUp.html
new file mode 100644
index 0000000000..d83c2e0079
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/removeformat-in-number-input-immediately-after-type-change-and-stepUp.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  const input = document.querySelector("input");
+  input.select();
+  input.type = "number";
+  document.querySelector("switch").scrollIntoView(true);
+  input.stepUp(1);
+  document.execCommand("removeFormat");
+});
+</script>
+</head>
+<body>
+<input>
+<switch>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/remve-documentElement-after-inserthtml-svg-and-td.html b/testing/web-platform/tests/editing/crashtests/remve-documentElement-after-inserthtml-svg-and-td.html
new file mode 100644
index 0000000000..eebeac317d
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/remve-documentElement-after-inserthtml-svg-and-td.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+addEventListener("load", () => {
+  document.querySelector("div[contenteditable]").focus();
+  document.execCommand("inserthtml", false, "<svg><td>");
+  document.documentElement.remove();
+});
+</script>
+</head>
+
+<body><div contenteditable></div></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/replace-document-root-with-object-and-mo.html b/testing/web-platform/tests/editing/crashtests/replace-document-root-with-object-and-mo.html
new file mode 100644
index 0000000000..bdad541422
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/replace-document-root-with-object-and-mo.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+addEventListener("load", () => {
+  const object = document.querySelector("object[contenteditable]");
+  const mo = object.querySelector("mo");
+  const range = new Range();
+  document.replaceChildren();
+  range.insertNode(object);
+  object.replaceChild(mo, object.firstChild);
+});
+</script>
+</head>
+<object contenteditable>
+  <mo>
+  </mo>
+</object>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/replace-parent-of-editing-host-on-DOMSubtreeModified.html b/testing/web-platform/tests/editing/crashtests/replace-parent-of-editing-host-on-DOMSubtreeModified.html
new file mode 100644
index 0000000000..9d431aa860
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/replace-parent-of-editing-host-on-DOMSubtreeModified.html
@@ -0,0 +1,28 @@
+<!doctype html>
+<html>
+<head>
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  getSelection().collapse(document.querySelector("content"), 1);
+  document.querySelector("div[contenteditable]").addEventListener("DOMSubtreeModified", () => {
+    document.querySelector("tr").replaceChild(
+      document.querySelector("meter"),
+      document.querySelector("th")
+    );
+  });
+  document.execCommand("justifyFull");
+});
+</script>
+</head>
+<body>
+<table>
+<tr>
+<th>
+<div contenteditable>
+<meter>
+<content>
+<ul></ul>
+</div>
+</th></tr></table>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/selectall-and-inerthtml-in-textarea-editing-host.html b/testing/web-platform/tests/editing/crashtests/selectall-and-inerthtml-in-textarea-editing-host.html
new file mode 100644
index 0000000000..8b0e36cd65
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/selectall-and-inerthtml-in-textarea-editing-host.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.execCommand("selectAll", false, null);
+  document.execCommand("inserthtml", false, "<p>");
+}
+
+</script>
+</head>
+
+<body onload="boom();"><textarea contenteditable="true"></textarea></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/selectall-in-head-editing-host-after-body-removed.html b/testing/web-platform/tests/editing/crashtests/selectall-in-head-editing-host-after-body-removed.html
new file mode 100644
index 0000000000..786ea25d9a
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/selectall-in-head-editing-host-after-body-removed.html
@@ -0,0 +1,19 @@
+<html><head><script type="text/javascript">
+
+function boom()
+{
+  var dE = document.documentElement;
+  var head = document.getElementsByTagName("head")[0];
+  dE.removeChild(document.body);
+  dE.contentEditable = "true";
+  dE.focus();
+  dE.contentEditable = "false";
+  head.focus();
+  head.contentEditable = "true";
+  try {
+    document.execCommand("selectAll", false, "");
+  } catch(e) {
+  }
+}
+
+</script></head><body onload="boom();"></body></html>
\ No newline at end of file
diff --git a/testing/web-platform/tests/editing/crashtests/selectall-selection-modify-move-forward-lineboundary-selectall-around-editable-canvas.html b/testing/web-platform/tests/editing/crashtests/selectall-selection-modify-move-forward-lineboundary-selectall-around-editable-canvas.html
new file mode 100644
index 0000000000..8e57700af5
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/selectall-selection-modify-move-forward-lineboundary-selectall-around-editable-canvas.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<script>
+onload = () => {
+  document.querySelector("canvas[contenteditable]").blur();
+  document.execCommand("selectAll", false);
+  getSelection().modify("move", "forward", "lineboundary");
+  document.execCommand("selectAll", false);
+};
+</script>
+<canvas contenteditable="true">
+<audio controls>
diff --git a/testing/web-platform/tests/editing/crashtests/selection-modify-around-input-in-contenteditable.html b/testing/web-platform/tests/editing/crashtests/selection-modify-around-input-in-contenteditable.html
new file mode 100644
index 0000000000..90b615da5c
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/selection-modify-around-input-in-contenteditable.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+addEventListener("load", () => {
+  const selection = window.getSelection();
+  const range = selection.getRangeAt(0);
+  selection.modify("move", "backward", "character");
+  selection.addRange(range);
+});
+</script>
+</head>
+<body>
+<fieldset contenteditable spellcheck="true">
+  <input value="x">
+  <table>
+    <caption></caption>
+  </table>
+</fieldset>
+</body>
+</html>
\ No newline at end of file
diff --git a/testing/web-platform/tests/editing/crashtests/selection-modify-extend-backward-character-to-outside-body-in-designMode.html b/testing/web-platform/tests/editing/crashtests/selection-modify-extend-backward-character-to-outside-body-in-designMode.html
new file mode 100644
index 0000000000..9f465cc462
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/selection-modify-extend-backward-character-to-outside-body-in-designMode.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<script>
+onload = () => {
+  document.designMode = 'on';
+  getSelection().selectAllChildren(document.body);
+  getSelection().modify('extend', 'backward', 'character');
+};
+</script>
+<audio controls>
diff --git a/testing/web-platform/tests/editing/crashtests/set-input-value-of-editing-host-after-changing-type.html b/testing/web-platform/tests/editing/crashtests/set-input-value-of-editing-host-after-changing-type.html
new file mode 100644
index 0000000000..34a1558896
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/set-input-value-of-editing-host-after-changing-type.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  const input = document.querySelector("input");
+  input.focus();
+  input.type = "text";
+  input.value = "new value";
+}, {once: true});
+</script>
+</head>
+<body><input type="button" contenteditable></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/set-output-value-to-empty-while-deleting-its-content.html b/testing/web-platform/tests/editing/crashtests/set-output-value-to-empty-while-deleting-its-content.html
new file mode 100644
index 0000000000..6ddf89205f
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/set-output-value-to-empty-while-deleting-its-content.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  document.designMode = "on";
+  window.find("AA");
+  document.addEventListener(
+    "selectionchange",
+    onSelectionChangeOrDOMNodeInserted,
+    {once: true}
+  );
+  document.querySelector("output").addEventListener(
+    "DOMNodeInserted",
+    onSelectionChangeOrDOMNodeInserted
+  );
+  document.execCommand("forwarddelete");
+});
+
+function onSelectionChangeOrDOMNodeInserted() {
+  document.execCommand("delete");
+  document.querySelector("output").value = "";
+}
+</script>
+</head>
+<body>
+<output>
+<ruby></ruby>
+<div>
+AAA
+</div></output></body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/set-selection-range-after-updating-textarea-default-value.html b/testing/web-platform/tests/editing/crashtests/set-selection-range-after-updating-textarea-default-value.html
new file mode 100644
index 0000000000..421306fc96
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/set-selection-range-after-updating-textarea-default-value.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+addEventListener("load", () => {
+  const textarea = document.createElement("textarea");
+  document.documentElement.appendChild(textarea);
+  textarea.focus();
+  textarea.dir = "rtl";
+  textarea.prepend("0123456789A", document.createElement("marquee"));
+  textarea.setSelectionRange(8, 13, "");
+});
+</script>
+</head>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/support/unloading-editor-in-subdocument-containing-misspelled-word-iframe.html b/testing/web-platform/tests/editing/crashtests/support/unloading-editor-in-subdocument-containing-misspelled-word-iframe.html
new file mode 100644
index 0000000000..cfedfa8d2e
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/support/unloading-editor-in-subdocument-containing-misspelled-word-iframe.html
@@ -0,0 +1 @@
+<html><meta charset="utf-8"><body><textarea>notaword</textarea></body></html>
diff --git a/testing/web-platform/tests/editing/crashtests/textarea-will-be-blurred-by-focus-event-listener.html b/testing/web-platform/tests/editing/crashtests/textarea-will-be-blurred-by-focus-event-listener.html
new file mode 100644
index 0000000000..bcb145c309
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/textarea-will-be-blurred-by-focus-event-listener.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html class="test-wait">
+<meta charset="utf-8">
+<script>
+addEventListener("load", () => {
+  const textarea = document.querySelector("textarea");
+  textarea.addEventListener("focus", () => {
+    textarea.select();
+    textarea.parentElement.setAttribute("hidden", "hidden");
+    setTimeout(() => document.documentElement.removeAttribute("class"), 0);
+  });
+  textarea.focus();
+});
+</script>
+<div><textarea>abc</textarea></div>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/unloading-editor-in-subdocument-containing-misspelled-word.html b/testing/web-platform/tests/editing/crashtests/unloading-editor-in-subdocument-containing-misspelled-word.html
new file mode 100644
index 0000000000..1b90e1d56a
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/unloading-editor-in-subdocument-containing-misspelled-word.html
@@ -0,0 +1,11 @@
+<html class="test-wait">
+<head>
+<meta charset="utf-8">
+<title>Test case for bug 459613 of Mozilla</title>
+</head>
+<body>
+<iframe
+  srcdoc="support/unloading-editor-in-subdocument-containing-misspelled-word-iframe.html"
+  onload="document.documentElement.removeAttribute('class')"></iframe>
+</body>
+</html>
diff --git a/testing/web-platform/tests/editing/crashtests/update-dom-during-undoing-in-textarea.html b/testing/web-platform/tests/editing/crashtests/update-dom-during-undoing-in-textarea.html
new file mode 100644
index 0000000000..56f7f82a21
--- /dev/null
+++ b/testing/web-platform/tests/editing/crashtests/update-dom-during-undoing-in-textarea.html
@@ -0,0 +1,32 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<title>Test for updating the DOM tree while execCommand("undo") is running in the textarea</title>
+<script>
+"use strict";
+
+let count = 0;
+addEventListener("load", () => {
+  document.execCommand("insertText", false, "F");
+  document.execCommand("undo");
+});
+
+function onInputOfTextarea() {
+  if (count) {
+    document.querySelector("base").appendChild(
+      document.querySelector("content")
+    );
+  }
+  count++;
+}
+</script>
+</head>
+<body>
+<iframe></iframe>
+<textarea autofocus oninput="onInputOfTextarea()">a</textarea>
+<base></base>
+<content>
+<menu>
+</body>
+</html>
-- 
cgit v1.2.3