chromium/third_party/blink/web_tests/editing/pasteboard/paste-removing-iframe.html

<html>
<head>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

function test()
{
    var toRemove = document.getElementById("child");
    var childDocument = toRemove.contentDocument;

    var textarea = childDocument.getElementById("target");
    textarea.addEventListener("input", function(evt) {
        toRemove.parentNode.removeChild(toRemove);
        if (window.testRunner)
            testRunner.notifyDone();
    });

    var selection = childDocument.getSelection();
    var data = childDocument.getElementById("data");
    selection.selectAllChildren(data);
    childDocument.execCommand("copy");
    textarea.select();
    childDocument.execCommand("paste");
}
</script>
</head>
<body>
<!--
  -- This test removes an iframe with editable content 
  -- during actually editing that editable text by handling DOM input event.
  -- WebKit should not crash even after this brutal removal.
  -->
<h1>PASS</h1>
<iframe id="child" onload="test()" src="resources/paste-removing-iframe-child.html" />
</body>
</html>