commit-pending-selection-crash.html

<!DOCTYPE html>
<script src="../editing.js"></script>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<input id="input1" type="text" style="height: 20px;">
<script>
test(function() {
  input = document.getElementById('input1');
  input.oninput = function() {
    input.setRangeText('abc', input.selectionStart, input.selectionEnd, 'select');
    input.style.height = '120px';  // change layout
  }
  input.focus();
  if (window.eventSender)
      eventSender.keyDown('a');
}, 'Change layout and commit pending selection at the same time');
</script>

chromium/third_party/blink/web_tests/editing/selection/commit-pending-selection-crash.html