1 files changed, 38 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/1402904.html b/editor/libeditor/crashtests/1402904.html
new file mode 100644
index 0000000000..544d01208a
--- /dev/null
+++ b/editor/libeditor/crashtests/1402904.html
@@ -0,0 +1,38 @@
+<script>
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // parent of <embed> (<embed> is not a container, therefore, its parent is the
+  // deepest last child container element of the <body>).
+  getSelection().collapse(
+    document.querySelector("embed").parentElement,
+    document.querySelector("embed").parentElement.childNodes.length
+  ); // Point the <embed>
+  const option = document.querySelector("option");
+  option.addEventListener("click", () => {
+    document.execCommand("forwardDelete");
+  });
+  const li2 = document.getElementById("li2");
+  li2.addEventListener("DOMNodeInserted", () => {
+    option.click();
+  });
+  const select = document.querySelector("select");
+  select.parentElement.setAttribute("onpageshow", "onPageShow()");
+}
+
+function onPageShow() {
+  const li1 = document.getElementById("li1");
+  li1.addEventListener("DOMSubtreeModified", () => {
+    document.execCommand("selectAll");
+    document.execCommand("indent");
+  });
+  li1.appendChild(document.createElement("legend"));
+}
+</script>
+<body onload="onLoad()">
+<select>
+<option></option>
+</select>
+<li id="li1"></li>
+<ul contenteditable="true">
+<li id="li2"></li>
+<embed>a;#2