chromium/third_party/blink/web_tests/editing/selection/select_all/select_all_iframe_crash.html

<!doctype html>
<script src="../../../resources/testharness.js"></script>
<script src="../../../resources/testharnessreport.js"></script>
<div id="sample">foo</div>
<div id="log"></div>
<script>
var test = async_test('Remove IFRAME in load event handler should not crash');
var sample = document.getElementById('sample');
var iframe = document.createElement('iframe');
iframe.srcdoc = 'foo';
iframe.onload = function () {
    document.execCommand('selectAll');
    iframe.remove();
    window.setTimeout(function() {
        test.step(function() {
            var selection = window.getSelection();
            assert_equals(selection.anchorNode, sample.firstChild, 'anchorNode');
            assert_equals(selection.anchorOffset, 0, 'anchorOffset');
            assert_equals(selection.focusNode, sample.firstChild, 'focusNode');
            assert_equals(selection.focusOffset, 3, 'focusOffset');
        });
        test.done();
    }, 0);
};
sample.appendChild(iframe);
</script>