chromium/third_party/blink/web_tests/editing/execCommand/remove-foramt-mixed-editable-crash.html

<!DOCTYPE html>
<html>
<head>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

onload = function() {
    document.execCommand('SelectAll');
    document.execCommand('RemoveFormat');
    document.body.textContent = 'PASS if Blink doesn\'t crash.';
};
</script>
</head>
<body contenteditable="true">
<span contenteditable="false"></span><code></code><b><span></span>ab</b>
</body>
</html>