chromium/third_party/blink/web_tests/editing/shadow/bold-twice-in-shadow.html

<!DOCTYPE html>
<html>
<body>
<script src="../../fast/dom/resources/event-sender-util.js"></script>

<p>Applying document.execCommand('Bold') to elements having insertion points (&lt;shadow&gt; or &lt;content&gt;) shoud not cause a crash.</p>
<p>To test manually, make a selection from somewhere in "nested before" to somehwere in "nested after", then press Ctrl+B twice. It should not cause a crash.</p>

<div id="container" contenteditable>
    before host
    <div id="host">    <span contenteditable="false">not editable<span></div>
    after host
</div>
<pre id="console"></pre>

<script>
if (window.testRunner)
    testRunner.dumpAsText();

var shadowRoot = host.attachShadow({mode: 'open'});
shadowRoot.innerHTML = '<div id="shadow-host"><span contenteditable>shadow before</span><shadow></shadow>shadow (after)</div>';

var nestedShadowHost = shadowRoot.getElementById('shadow-host');
var nestedShadowRoot = nestedShadowHost.attachShadow({mode: 'open'});
nestedShadowRoot.innerHTML = '<div id="inner" contenteditable>nested before<shadow></shadow>nested after</div>';

if (window.eventSender) {
    var div = nestedShadowRoot.getElementById('inner');

    eventSender.mouseMoveTo(div.offsetLeft + 5, div.offsetTop + div.offsetHeight / 2);
    eventSender.mouseDown();
    eventSender.mouseMoveTo(div.offsetLeft + div.offsetWidth - 5, div.offsetTop + div.offsetHeight / 2);
    eventSender.mouseUp();

    document.execCommand('Bold');
    document.execCommand('Bold');

    container.innerHTML = "PASS";
}
</script>
</body>
</html>