chromium/third_party/blink/web_tests/editing/style/block-style-progress-crash.html

<!DOCTYPE html>
<html>
<head>
<script>

if (window.testRunner)
    testRunner.dumpAsText();

function runTest() {
    var r = document.createRange();
    getSelection().addRange(r);
    document.execCommand('justifyRight', null, true);
    document.body.innerHTML = 'PASS';
}

</script>
</head>
<body onload="runTest()" contentEditable>
<progress >>