chromium/third_party/blink/web_tests/external/wpt/editing/crashtests/insertorderedlist-in-text-adopted-to-other-document.html

<!DOCTYPE html>
<html class="test-wait">
<head>
<script>
function init1()
{
  // Create an html:iframe in HTML mode (so designMode can be used 320092)
  targetIframe = document.createElementNS('http://www.w3.org/1999/xhtml', 'iframe');
  targetIframe.srcdoc = "<html></html>";
  targetIframe.setAttribute("style", "width: 700px; height: 500px; border: 1px dotted green;");
  targetIframe.addEventListener("load", init2);
  document.body.appendChild(targetIframe);
}

function init2()
{
  targetWindow = targetIframe.contentWindow;
  targetDocument = targetWindow.document;

  p = document.getElementById("p");
  pText = p.firstChild;

  targetDocument.body.appendChild(targetDocument.adoptNode(p, true));

  targetDocument.designMode = 'on';

  setTimeout(boom, 0);
}

function boom()
{
  var rng = targetDocument.createRange();
  rng.setStart(pText, 3);
  rng.setEnd(pText, 3);

  targetWindow.getSelection().addRange(rng);

  targetDocument.execCommand("insertorderedlist", false, null);

  document.documentElement.removeAttribute("class")
}
</script>
</head>

<body onload="init1();">
<p id="p">word word</p>
</body>

</html>