1 files changed, 24 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/1402526.html b/editor/libeditor/crashtests/1402526.html
new file mode 100644
index 0000000000..fd75a30eca
--- /dev/null
+++ b/editor/libeditor/crashtests/1402526.html
@@ -0,0 +1,24 @@
+<script>
+function onLoad() {
+  const shadow = document.querySelector("shadow");
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // <shadow> which is the deepest last child of the <body>.
+  getSelection().collapse(shadow, shadow.childNodes.length);
+  try {
+    document.querySelector("dd[contenteditable]").addEventListener(
+      "DOMNodeInserted",
+      () => {
+        try {
+          shadow.replaceWith("1");
+        } catch(e) {}
+      }
+    );
+  } catch(e) {}
+  try {
+    document.execCommand("justifyFull");
+  } catch(e) {}
+}
+</script>
+<body onload="onLoad();">
+<dd contenteditable>
+<shadow></body>