chromium/third_party/blink/web_tests/editing/execCommand/apply-style-command-crash.html

<!DOCTYPE html>
<html>
<head>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

onload = function() {
    x.innerHTML += '';
    document.designMode = 'on';
    document.execCommand('selectall');
    document.execCommand('bold');
    document.body.offsetTop;
    document.body.innerHTML = "PASS. WebKit didn't crash";
    if (window.testRunner)
        testRunner.notifyDone();
}
</script>
</head>
<body>
<div id="x">
<iframe src="data:"></iframe>
<div>
<input></input>
</div>
</ul>
</body>
</html>