chromium/third_party/blink/web_tests/editing/undo/redo-selection-modify-crash.html

<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script src="../assert_selection.js"></script>
<div id="log"></div>
<script>
test(() => {
    assert_selection(
        '<div contenteditable>|foo<br><i>bar</i></div>',
        selection => {
            // Make base/extent and start/end different.
            selection.modify('extend', 'forward', 'word');
            selection.document.execCommand('justifyLeft');
            selection.document.execCommand('undo');
            // Remove an anchor node for extent position of redo
            selection.document.querySelector('i').remove();
            selection.document.execCommand('redo');
        },
        '<div contenteditable>^foo|<br></div>');
});
</script>