From 9e3c08db40b8916968b9f30096c7be3f00ce9647 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Sun, 21 Apr 2024 13:44:51 +0200
Subject: Adding upstream version 1:115.7.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 editor/libeditor/crashtests/1364133.html | 42 ++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 editor/libeditor/crashtests/1364133.html

(limited to 'editor/libeditor/crashtests/1364133.html')
diff --git a/editor/libeditor/crashtests/1364133.html b/editor/libeditor/crashtests/1364133.html
new file mode 100644
index 0000000000..a1d06fba98
--- /dev/null
+++ b/editor/libeditor/crashtests/1364133.html
@@ -0,0 +1,42 @@
+<html>
+  <head>
+    <script>
+      var tr = document.createElement('tr');
+      document.documentElement.appendChild(tr);
+
+      var a1 = document.createElement('a');
+      document.documentElement.appendChild(a1);
+      var a2 = document.createElement('a');
+      tr.appendChild(a2);
+
+      var a3 = document.createElement('a');
+      document.documentElement.appendChild(a3);
+
+      var a4 = document.createElement('a');
+      document.documentElement.appendChild(a4);
+
+      var a5 = document.createElement('a');
+      a1.appendChild(a5);
+
+      var input = document.createElement('input');
+      document.documentElement.appendChild(input);
+
+      a3.contentEditable = true;
+      a5.innerText = "xx";
+      a4.outerHTML = "";
+      input.select();
+
+      document.replaceChild(document.documentElement, document.documentElement);
+      window.find("x", false, false, false, false, false, false);
+
+      var range = document.createRange();
+      range.setStart(a1, 1);
+      window.getSelection().addRange(range);
+
+      document.designMode = "on";
+
+      range.selectNode(a2);
+      document.execCommand("forecolor", false, "-moz-default-background-color");
+    </script>
+  </head>
+</html>
-- 
cgit v1.2.3

