chromium/third_party/blink/web_tests/editing/shadow/insertorderedlist-crash.html

<!DOCTYPE html>
<html>
<body>

<p>This test confirms some combination of editing command with Shadow DOM does not cause a crash.
To test manually, select from (before nested) to (after nested), then press Italic, and InsertUnorderedList.</p>

<div id="container" contenteditable>
    <div><p>(before host)</p></div>
    <div id="host">    <span contenteditable="false">not editable</span></div>
    <div>(after host)</div>

    <input type="button" value="Italic" onclick="document.execCommand('Italic')" />
    <input type="button" value="InsertUnorderedList" onclick="document.execCommand('InsertUnorderedList')" />
</div>

<script>
if (window.testRunner)
    testRunner.dumpAsText();

var shadowRoot = host.attachShadow({mode: 'open'});
var div = document.createElement('div');
shadowRoot.appendChild(div);
div.innerHTML = "<span contenteditable>(before shadow)</span><shadow></shadow>(after shadow)";

var nestedShadowRoot = div.attachShadow({mode: 'open'});
nestedShadowRoot.innerHTML = "<div contenteditable>(before <span id='src'></span>nested)<shadow></shadow>(nested <span id='dst'></span>after)</div>";

var src = nestedShadowRoot.getElementById('src');
var dst = nestedShadowRoot.getElementById('dst');

if (window.eventSender) {
    eventSender.mouseMoveTo(src.offsetLeft + src.offsetWidth / 2, src.offsetTop + src.offsetHeight / 2);
    eventSender.mouseDown();
    eventSender.mouseMoveTo(dst.offsetLeft + dst.offsetWidth / 2, dst.offsetTop + dst.offsetHeight / 2);
    eventSender.mouseUp();

    document.execCommand('Italic');
    document.execCommand('InsertUnorderedList');

    container.innerHTML = "PASS";
}

var successfullyParsed = true;
</script>

</body>
</html>