crash-delete-from-document.html | Explore in Territory

<!DOCTYPE html>
<head>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

window.onload = function () {
    document.designMode = 'on';

    document.body.textContent = 'aaaa';
    document.execCommand('SelectAll');
    document.execCommand('Italic');
    window.getSelection().deleteFromDocument();

    document.execCommand('Undo');
    window.getSelection().deleteFromDocument();

    document.body.textContent = 'PASS if Blink doesn\'t crash.';
};
</script>
</head>
<body>
</body>
</html>

chromium/third_party/blink/web_tests/editing/undo/crash-delete-from-document.html