<!DOCTYPE html>
<script>
    function frameLoaded() {
        if (document.counter)
            document.counter++;
        else
            document.counter = 1;

        if (document.counter <= 16) {
            document.designMode='on';
            document.execCommand('selectall');
            document.execCommand('italic');
        }
    }

    if (window.testRunner) {
        testRunner.dumpAsText();
        testRunner.waitUntilDone();
    }

    window.addEventListener("load", function() {
        document.getElementById("console").innerText = 'PASS';
        if (window.testRunner)
            testRunner.notifyDone();
    });
</script>


<h1><button><iframe></iframe></button>
</h1><input><iframe onload="frameLoaded()"></iframe>

<div id="console">FAIL</div>

<div>
    WebKit bug #<a href="https://bugs.webkit.org/show_bug.cgi?id=132103">132103</a>: Crash applying editing commands from iframe onload event.
</div>