chromium/third_party/blink/web_tests/external/wpt/editing/crashtests/set-output-value-to-empty-while-deleting-its-content.html

<!doctype html>
<html>
<head>
<meta charset="utf-8">
<script>
document.addEventListener("DOMContentLoaded", () => {
  document.designMode = "on";
  window.find("AA");
  document.addEventListener(
    "selectionchange",
    onSelectionChangeOrDOMNodeInserted,
    {once: true}
  );
  document.querySelector("output").addEventListener(
    "DOMNodeInserted",
    onSelectionChangeOrDOMNodeInserted
  );
  document.execCommand("forwarddelete");
});

function onSelectionChangeOrDOMNodeInserted() {
  document.execCommand("delete");
  document.querySelector("output").value = "";
}
</script>
</head>
<body>
<output>
<ruby></ruby>
<div>
AAA
</div></output></body>
</html>