chromium/third_party/blink/web_tests/editing/execCommand/indent-crash-by-top-load-event.html

<!DOCTYPE html>
<head>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script>
var t = async_test('Load event for the top-level frame should not happen during execCommand.  It could mutate the DOM tree, and caused a crash.');

document.addEventListener('readystatechange', function() {
    console.log('READYSTATECHANGE : ' + document.readyState);
    if (document.readyState == 'complete') {
        document.designMode = 'on';
        var r = document.createRange();
        r.selectNode(document.querySelector('table'));
        window.getSelection().addRange(r);
        document.execCommand('Indent');
        t.done();
    }
});

window.onload = function() {
    console.log('LAOD');
    document.querySelector('table').remove();
};
</script>
</head>
<body><form>
<iframe srcdoc="placeholder document"></iframe>
<table>