1 files changed, 23 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/1525481.html b/editor/libeditor/crashtests/1525481.html
new file mode 100644
index 0000000000..d96e1c2d0d
--- /dev/null
+++ b/editor/libeditor/crashtests/1525481.html
@@ -0,0 +1,23 @@
+<script>
+function onLoad() {
+  const button = document.querySelector("button");
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // <button> which is the deepest last child of the <body>.
+  getSelection().collapse(button, button.childNodes.length);
+  document.execCommand("styleWithCSS", false, true);
+  document.execCommand("delete");
+  document.querySelector("ul[contenteditable]")
+    .addEventListener("DOMNodeRemoved", () => {
+      const range = document.createRange();
+      range.setEndAfter(button);
+      getSelection().addRange(range);
+      getSelection().deleteFromDocument();
+    });
+  document.execCommand("outdent");
+}
+</script>
+<body onload="onLoad()">
+<ul contenteditable style="margin: -1px 0px 1px 6px">
+<dd></dd>
+<dd>
+<button></button>></dd></ul></body>