chromium/third_party/blink/web_tests/editing/selection/selectallchildren-crash.html

<!DOCTYPE html>
<body>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<div id=log></div>
<script>
var test = async_test('Do not crash in Selection.selectAllChildren().');
var doc2;
var selection;

test.step(function() {
    var iframe1 = document.createElement('iframe');
    iframe1.srcdoc = '<input autofocus>';
    window.addEventListener('focus', function() { document.write(); });
    document.documentElement.appendChild(iframe1);
    document.designMode = 'on';

    var iframe2 = document.createElement('iframe');
    iframe2.srcdoc = '<iframe></iframe>';
    iframe2.addEventListener('load', onLoadIframe2);
    document.documentElement.appendChild(iframe2);
});

function onLoadIframe2(e) {
    var w = e.target.contentWindow;
    doc2 = w.document;
    selection = w.getSelection();
    window.top.setTimeout(selectLater);
}

function selectLater() {
    selection.selectAllChildren(doc2);
    test.done();
}
</script>
</body>