chromium/third_party/blink/web_tests/editing/selection/4960137.html

<!DOCTYPE html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<p>This tests for an ASSERTion failure when setting the main frame's selection inside a node in a subframe.</p>
<iframe srcdoc="<body contenteditable='true'>hello world</body>" onload="onloadiframe();"></iframe>
<script>
  var tester = async_test();
  function onloadiframe() {
    const iframe = document.querySelector("iframe");
    const body = iframe.contentDocument.body;
    iframe.focus();
    iframe.contentDocument.addEventListener('selectionchange', ()=> {
      assert_equals(iframe.contentWindow.getSelection().anchorNode, body);
      tester.done();
      });
    // This should not crash.
    iframe.contentWindow.getSelection().setBaseAndExtent(body, 0, body, body.childNodes.length);
  }
</script>