chromium/third_party/blink/web_tests/editing/execCommand/crash-object-cloning.html

<!DOCTYPE html>
<html>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

window.onload = function() {
    document.execCommand("SelectAll");
    document.execCommand("Indent");
    document.body.innerHTML = "This test passes if it doesn't crash";
}
</script>
<body contenteditable>
<object>
Any fallback
</object>
</body>
</html>