chromium/third_party/blink/web_tests/editing/selection/undo-crash.html

<html><head>
<title>Undo crash</title>
</head>
<body onload="load()">
To run this test manually, type some text in the input field, then click the "Crash me" button.
<input id="testinput" type="text"></input>
<input id='testbutton' type="button" value="Crash me" onclick="crash()">
<ul id="console"></ul>
<script>

function load()
{
    document.getElementById('testinput').focus();
    if (window.testRunner)
        testRunner.dumpAsText();
    document.execCommand('InsertText', false, 'b');
    document.execCommand('InsertText', false, 'l');
    document.execCommand('InsertText', false, 'a');
    document.execCommand('InsertText', false, 'h');
    if (eventSender) {
        var button = document.getElementById('testbutton');
        eventSender.mouseMoveTo(button.offsetLeft + 10, button.offsetTop + 5)
        eventSender.mouseDown();
        eventSender.mouseUp();
    }
}

function crash()
{
    var elem = document.getElementById('testinput');
    elem.style.display = 'none';
    document.execCommand('undo');
    log("SUCCEEDED");
}

function log(str) {
    var li = document.createElement("li");
    li.appendChild(document.createTextNode(str));
    var console = document.getElementById("console");
    console.appendChild(li);
}
</script>
</body>
</html>