chromium/third_party/blink/web_tests/editing/execCommand/resources/format-block-crash-iframe.html

<!DOCTYPE html>
<html>
<head>
<title>FormatBlock crash test case</title>
</head>
<!-- This is a minified version of the clusterfuzz test case at https://code.google.com/p/chromium/issues/detail?id=345005 -->
<body style="display: table-row;">
<script>
function run()
{
    document.designMode = 'on';
    document.execCommand('SelectAll');
    document.execCommand('FormatBlock', false, '<' + 'div>');
    window.setTimeout(notifyFinish, 0);
}

function notifyFinish()
{
    window.parent.postMessage('FINISH', '*');
}

window.setTimeout(run, 0);
</script>
<span contenteditable="true" style="display: table-caption;"></span>
<span></span>
<div style="display: -webkit-inline-box;"><span><span>B</span></span></div>
<div></div>
</body>
</html>