Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/dom/mutation-event-tests/editing/deleting/delete-key-crash.html 

<!DOCTYPE html>
<html>
<body>
<div contenteditable id="div"><div>AB</div></div>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var count = 0;
div.addEventListener("DOMSubtreeModified", function () {
    count++;
    if (count == 2) {
        div.contenteditable = false;
        document.body.removeChild(div);
    }
});

document.getSelection().collapse(div.firstChild.firstChild, 2)
if (window.eventSender) {
    eventSender.keyDown('Backspace');
    eventSender.keyDown('Backspace');
}
document.body.innerText = "PASS if not crashed";
</script>
</body>
</html>