chromium/third_party/blink/web_tests/editing/style/justify-left-crash.html

<!doctype html>
<html hidden>
<head>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<style>
html, head, style {
    display: block;
}
</style>
</head>
<body>
<div id="sample">foo</div>
<script>
    document.designMode = 'on';
    document.execCommand('selectAll');
    document.execCommand('italic');
    document.execCommand('justifyLeft');
    document.documentElement.removeAttribute('hidden');

    test(() => {
        var sample = document.getElementById('sample');
        assert_equals(sample.innerHTML, 'foo');
        const selection = window.getSelection();
        assert_equals(selection.anchorNode, sample.firstChild, 'anchorNode');
        assert_equals(selection.anchorOffset, 0, 'anchorOffset');
        assert_equals(selection.focusNode, sample.firstChild, 'focusNode');
        assert_equals(selection.focusOffset, 0, 'focusOffset');
    }, 'This is a crash test.');
</script>
</body>
</html>