1 files changed, 68 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/633709.xhtml b/editor/libeditor/crashtests/633709.xhtml
new file mode 100644
index 0000000000..75ad518b8f
--- /dev/null
+++ b/editor/libeditor/crashtests/633709.xhtml
@@ -0,0 +1,68 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<body><div contenteditable="true"></div><div><input><div></div></input></div></body>
+
+<script>
+<![CDATA[
+function onLoad() {
+  // For emulating the traditional behavior, collapse Selection to end of the
+  // parent <div> of the <input>.  In XHTML document, the <input> may have the
+  // <div> child.  Therefore, the deepest last child container element of the
+  // <body> is the parent of the <input>.
+  getSelection().collapse(
+    document.querySelector("input").parentElement,
+    document.querySelector("input").parentElement.childNodes.length
+  );
+  document.querySelector("input").focus();
+
+  try {
+    document.execCommand("stylewithcss", false, "true");
+  } catch(e) {}
+  try {
+    document.execCommand("inserthtml", false, "<x>X</x>");
+  } catch(e) {}
+  try {
+    document.execCommand("underline");
+  } catch(e) {}
+  try {
+    document.execCommand("justifyfull");
+  } catch(e) {}
+  try {
+    document.execCommand("underline");
+  } catch(e) {}
+  try {
+    document.execCommand("insertParagraph");
+  } catch(e) {}
+  try {
+    document.execCommand("delete");
+  } catch(e) {}
+
+  try {
+    document.execCommand("stylewithcss", false, "false");
+  } catch(e) {}
+  try {
+    document.execCommand("inserthtml", false, "<x>X</x>");
+  } catch(e) {}
+  try {
+    document.execCommand("underline");
+  } catch(e) {}
+  try {
+    document.execCommand("justifyfull");
+  } catch(e) {}
+  try {
+    document.execCommand("underline");
+  } catch(e) {}
+  try {
+    document.execCommand("insertParagraph");
+  } catch(e) {}
+  try {
+    document.execCommand("delete");
+  } catch(e) {}
+
+  document.documentElement.removeAttribute("class");
+}
+addEventListener("load", onLoad);
+]]>
+</script>
+
+</html>