Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/editing/selection/clear-selection-crash.html 

<!DOCTYPE html>
<html>
<body>
<div style="display: -webkit-inline-box">
    <div id="start" style="display: -webkit-inline-box">
        <i>
            <div style="display: run-in; height: 1px"></div>
            <span id="span1" style="width: 1px">A</span>
        </i>
    </div>
    <i>B</i>
</div>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

document.body.offsetTop;
document.designMode = 'on';
document.execCommand('selectall');
document.body.offsetTop;
span1.style.display = 'block';

document.body.offsetTop;
document.body.innerHTML = "PASS. WebKit didn't crash.";
</script>
</body>
</html>