chromium/third_party/blink/web_tests/fast/html/crash-on-invalid-selection-index.html

<!DOCTYPE html>
<select multiple autofocus>
    <option selected disabled></option>
</select>
<img src="foo.bar"></img>
<p>PASS if it does not crash in debug.</p>
<script>
onload = function() {
    document.execCommand("selectAll");

    if (window.testRunner)
        testRunner.dumpAsText();
}
</script>