format-block-removes-destination-crash.html

<!DOCTYPE html>
<body onload="crash();" contenteditable>
<strike style='display: flex;'>foo<select id="target">bar
<script>
function crash() {
  if (window.testRunner)
  	testRunner.dumpAsText();
  document.designMode = "on";
  r = document.createRange();
  r.selectNode(target);
  window.getSelection().addRange(r);
  document.execCommand("FormatBlock", false, "address")
  document.write("Test passes if no crash.")
}
</script>

chromium/third_party/blink/web_tests/editing/execCommand/format-block-removes-destination-crash.html