unlistify-body-crash.html | Explore in Territory

<!DOCTYPE html>
<html>
<head>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function doReplace(tagName) {
    var oldElement = document.getElementById(tagName);
    var newElement = document.createElement(tagName);
    while (oldElement.firstChild) {
        newElement.appendChild(oldElement.firstChild);
    }
    oldElement.parentNode.replaceChild(newElement, oldElement);
}
onload = function() {
    doReplace('body');

    document.designMode = 'on';
    getSelection().collapse(document.querySelector('li'), 1);
    document.execCommand('InsertUnorderedList');
    document.documentElement.textContent = 'PASS if Blink doesn\'t crash.';
};
</script>
</head>
<body>
<h6><ul><li><div id="body"><h6>bar<ul></ul></h6></div><br></li></ul></h6>
</body>
</html>

chromium/third_party/blink/web_tests/editing/execCommand/unlistify-body-crash.html