chromium/third_party/blink/web_tests/editing/execCommand/replaceSelectorCommand-crash.html

<!DOCTYPE html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script>
  const testObject = async_test('Does not crash');

  var af = [], i = 0;
  var setIntervalId;
  var done = false;

  function main() {
    testObject.step(() => {
      if (done)
        return;

      if (i == 20 * af.length) {
        done = true;
        document.body.innerHTML += "<p>Test for crbug.com/338982. Passes if it does not crash</p>";
        document.body.innerHTML += "<p>PASS</p>";
        clearInterval(setIntervalId);
        testObject.done();
        return;
      }

      af[i++ % af.length]();
    });
  }

  af.push(function() {
    document.designMode="on";
    document.execCommand("SelectAll");
    try {
      window._Document_0 = document;
    } catch(e) {
      console.log(e)
    };
  });

  af.push(function() {
    document.execCommand("Underline", false);
  });

  af.push(function() {
    try {
      window._Selection_0 = window._Document_0.getSelection();
    } catch(e) {
      console.log(e)
    };
  });

  af.push(function() {
    document.execCommand("InsertParagraph");
  });

  af.push(function() {
    try {
      window._Selection_0.modify("move", "forward", "line");
    } catch(e) {
      console.log(e)
    }
    document.execCommand("Delete", false);
  });

  af.push(function() {
    document.execCommand("Indent");
  });

  af.push(function() {
    document.execCommand("InsertOrderedList");
    document.execCommand("InsertImage", false);
  });

  af.push(function() {});
  af.push(function() {});
  af.push(function() {});

  document.addEventListener("DOMNodeInserted", main, false);
  setIntervalId = setInterval(main, 10);
</script>
<input>