chromium/third_party/blink/web_tests/fast/forms/text/text-field-setvalue-crash.html

<script>
if (window.testRunner)
    testRunner.dumpAsText();

function test()
{
	var emailID=document.apply.EmailAdd;
	emailID.focus();
	document.execCommand("InsertText", false, "aaa")
	emailID.value="";
	document.execCommand("InsertText", false, "aaa")
	document.execCommand("Undo");
	document.execCommand("Undo");
}

</script>

<BODY onload="test()">
<p>This test checks that undoing across a programmatic change to a
text field's value doesn't cause crashes or assertion failures. If
this test does not crash, it has passed.</p>

<form name="apply"> 
<input name="EmailAdd" type="text" onBlur="javascript:ValidateForm();">
</form>

</body>
</html>