chromium/third_party/blink/web_tests/editing/selection/modify-crash.html

<!DOCTYPE html>
<html>
<head>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}
window.onload = function () {
    var oSelection = window.getSelection();
    document.execCommand('SelectAll');
    var oRange = oSelection.getRangeAt(0);
    oRange.deleteContents();
    oSelection.modify('extend', 'backward', 'paragraph');

    // Recreate the HTML element to show 'PASS'.
    document.body.innerHTML = '<body>PASS if not crashed.</body>';
    if (window.testRunner)
        testRunner.notifyDone();
}
</script>
</head>
<body>
>
<optgroup></optgroup>
</body>
</html>