chromium/third_party/blink/web_tests/fast/parser/nested-fragment-parser-crash.html

<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
x<h4><strike>x
This test passes if it doesn't crash.
<script>
  var counter = 0;
  window.onload=function(){
    test(function(){
      document.execCommand("SelectAll");
      document.designMode="on";
      document.execCommand("Indent");
      document.execCommand("InsertOrderedList", false);
    });
  };
  function handler() {
    // This constant is somewhat magic. It's the smallest constant such that
    // we'll exceed the maxium call stack size.
    if (++counter >= 34)
      document.removeEventListener("DOMSubtreeModified", handler, false);
    document.execCommand("outdent", false);
  };
  document.addEventListener("DOMSubtreeModified", handler, false);
</script>