1 files changed, 18 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/1596516.html b/editor/libeditor/crashtests/1596516.html
new file mode 100644
index 0000000000..37b9c5889c
--- /dev/null
+++ b/editor/libeditor/crashtests/1596516.html
@@ -0,0 +1,18 @@
+<html>
+<head>
+    <script>
+      function start () {
+        const italic = document.createElementNS('http://www.w3.org/1999/xhtml', 'i')
+        italic.dir = ''
+        document.documentElement.contentEditable = 'true'
+        const selection = document.getSelection()
+        const range = selection.getRangeAt(0)
+        const attribute = italic.attributes.getNamedItem('dir')
+        range.setEnd(attribute, (2361162229 % attribute.childNodes))
+        document.queryCommandState('heading')
+      }
+
+      document.addEventListener('DOMContentLoaded', start)
+    </script>
+</head>
+</html>