chromium/third_party/blink/web_tests/editing/selection/selection-plugin-clear-crash.html

<!DOCTYPE html>
<html>
<script>
if (window.testRunner)
    testRunner.dumpAsText();
    
function runTest()
{
    var obj = document.getElementById("test");
    var s = window.getSelection();
    // The initscript attribute is run (synchronously) when the plugin is created.
    if (obj)
        s.collapse(obj, 0);
    else
        s.removeAllRanges();
    document.body.innerHTML = "PASS";
}
</script>
<body onload="runTest()">
<div>
<object id="test"></object>
<embed type="application/x-blink-deprecated-test-plugin" initscript="document.body.innerHTML = '';"></embed>
</div>
</body>
</html>