1 files changed, 21 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/766305.html b/editor/libeditor/crashtests/766305.html
new file mode 100644
index 000000000..a5000fe73
--- /dev/null
+++ b/editor/libeditor/crashtests/766305.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var s = "x";
+  for (var i = 0; i < 15; ++i)
+    s = s + s;
+  var t = document.createTextNode(s);
+  document.body.appendChild(t);
+  window.getSelection().collapse(t, s.length);
+  document.execCommand("insertText", false, "a");
+}
+
+</script>
+</head>
+
+<body contenteditable="true" onload="boom();"></body>
+</html>