chromium/third_party/blink/web_tests/editing/execCommand/value-without-selection-crash.html

<!DOCTYPE html>
<html>
<body>
<script>

if (window.testRunner)
    testRunner.dumpAsText();

document.designMode = 'on';
window.getSelection().removeAllRanges();
document.queryCommandValue('backColor', false, null);
document.queryCommandValue('fontSize', false, null);
document.queryCommandValue('fontName', false, null);
document.queryCommandValue('foreColor', false, null);

document.writeln('PASS - WebKit did not crash when querying command value without selection.');
</script>
</body>
</html>