listify-output-crash.html | Explore in Territory

<!DOCTYPE html>
<head>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

onload = function() {
    document.execCommand('SelectAll');
    document.execCommand('InsertUnorderedList');
    document.body.textContent = 'PASS if Blink doesn\'t crash.';
}
</script>
</head>
<body contenteditable="true"><output>
<option>12</option>after
</body>
</html>

chromium/third_party/blink/web_tests/editing/execCommand/listify-output-crash.html