chromium/third_party/blink/web_tests/css3/flexbox/insert-text-crash.html

<style>
#el2 {
    display: flex;
    border: 1px solid red;
}
#el3 {
    position: absolute;
    border: 1px solid green;
}
</style>
<body contenteditable=true>
<div id="el2"><div id="el3">AA </div></div>
</body>
<script>
if (window.testRunner)
    testRunner.dumpAsText();
document.execCommand('selectall')
document.execCommand('inserttext', '')
document.body.innerText = "This test passes if it does not crash.";
</script>