insert-with-javascript-protocol-crash.html

<script>
onload = function() {
    document.execCommand('selectall');
    var iframe = document.createElement('iframe');
    iframe.onload = startIframe;
    document.documentElement.appendChild(iframe);
    document.body.textContent = 'PASS; NOT CRASHED';
    if (window.testRunner)
        testRunner.dumpAsText();
};

function startIframe()
{
    document.designMode = 'on';
    document.execCommand('justifyfull');
    document.execCommand('insertimage', false, 'x.gif');
    document.execCommand('indent');
    document.execCommand('inserthtml', false, '<iframe></iframe>')
    document.execCommand('inserthtml', false, '<iframe src="javascript:window.top.startIFrame2()"></iframe>');
}

var counter = 0;
function startIFrame2()
{
    try {
        ++counter;
        if (counter >= 22)
            return;
        document.execCommand('justifyleft');
        document.execCommand('indent');
        document.execCommand('forwardDelete');
    } catch (e) {
        // Catch "Uncaught RangeError: Maximum call stack size exceeded."
    }
}
</script>
<body></body>

chromium/third_party/blink/web_tests/editing/inserting/insert-with-javascript-protocol-crash.html