chromium/third_party/blink/web_tests/editing/selection/modify_move/move-by-character-crash-test-textarea.html

<!DOCTYPE html>
<script src="../../../resources/testharness.js"></script>
<script src="../../../resources/testharnessreport.js"></script>
<html>
<body>
<textarea id="editor">&#8238;LTR
</textarea>
<script>
test(function() {
    var sel = window.getSelection();
    sel.empty();
    var test = document.getElementById("editor");
    test.focus();
    test.selectionDirection = 'none';
    test.selectionStart = 0;
    test.selectionEnd = 0;
    getSelection().modify("move", "left", "character");
    getSelection().modify("move", "left", "character");
    test.selectionDirection = 'none';
    test.selectionStart = 1;
    test.selectionEnd = 1;
    getSelection().modify("move", "right", "character");
    getSelection().modify("move", "right", "character");
}, "This test sets caret at the beginning of backward text and moving the character to left and right.");
</script>
</body>
</html>