1 files changed, 40 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/1405747.html b/editor/libeditor/crashtests/1405747.html
new file mode 100644
index 0000000000..dae3a130f0
--- /dev/null
+++ b/editor/libeditor/crashtests/1405747.html
@@ -0,0 +1,40 @@
+<script>
+let th;
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // <colgroup> which is the last child of the <body>.
+  getSelection().collapse(
+    document.querySelector("colgroup"),
+    document.querySelector("colgroup").childNodes.length
+  );
+  th = document.querySelector("th"); // Cache the target for removing the event handler.
+  try {
+    th.addEventListener("DOMSubtreeModified", onDOMSubtreeModified);
+  } catch(e) {}
+  try {
+    th.align = "";
+  } catch(e) {}
+}
+
+let count = 0;
+function onDOMSubtreeModified() {
+  if (count++ == 1) {
+    // If we didn't stop testing this, this event handler would be called too
+    // many times.  It's enough to run twice to reproduce the bug report.
+    th.removeEventListener("DOMSubtreeModified", onDOMSubtreeModified);
+  }
+  try {
+    document.execCommand("selectAll");
+  } catch(e) {}
+  try {
+    document.execCommand("justifyCenter");
+  } catch(e) {}
+  try {
+    document.execCommand("forwardDelete");
+  } catch(e) {}
+}
+</script>
+<body onload="onLoad()">
+<table contenteditable>
+<th></th>
+<colgroup></body>