1 files changed, 37 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/336104.html b/editor/libeditor/crashtests/336104.html
new file mode 100644
index 0000000000..32f11b745d
--- /dev/null
+++ b/editor/libeditor/crashtests/336104.html
@@ -0,0 +1,37 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function init()
+{
+  var targetWindow = window.frames[0];
+  var targetDocument = targetWindow.document;
+  var rootish = document.getElementById('rootish');
+
+  targetDocument.body.appendChild(targetDocument.adoptNode(rootish));
+  targetDocument.designMode = 'on';
+
+  targetWindow.getSelection().removeAllRanges();
+  
+  var r = targetDocument.createRange(); 
+  r.setStart(targetDocument.getElementById("start"), 0);
+  r.setEnd  (targetDocument.getElementById("endparent").firstChild, 0);
+  targetWindow.getSelection().addRange(r);
+  
+  targetDocument.execCommand('outdent', false, null);
+}
+</script>
+
+</head>
+
+<body onload="setTimeout(init, 300);">
+
+<iframe src="data:text/html," style="width: 95%; height: 500px;"></iframe>
+
+<div id="rootish">
+  <div id="start"></div>
+  <p>Huh</p>
+  <svg xmlns="http://www.w3.org/2000/svg" id="endparent"> </svg>
+</div>
+
+</body>
+</html>