LayoutTests/editing/style/apply-style-iframe-crash.html - WebKit - Git at Google

 <!DOCTYPE html>
 <script>
     function frameLoaded() {
         if (document.counter)
             document.counter++;
         else
             document.counter = 1;

         if (document.counter <= 16) {
             document.designMode='on';
             document.execCommand('selectall');
             document.execCommand('italic');
         }
     }

     if (window.testRunner) {
         testRunner.dumpAsText();
         testRunner.waitUntilDone();
     }

     window.addEventListener("load", function() {
         document.getElementById("console").innerText = 'PASS';
         if (window.testRunner)
             testRunner.notifyDone();
     });
 </script>


 <h1><button><iframe></iframe></button>
 </h1><input><iframe onload="frameLoaded()"></iframe>

 <div id="console">FAIL</div>

 <div>
     WebKit bug #<a href="https://bugs.webkit.org/show_bug.cgi?id=132103">132103</a>: Crash applying editing commands from iframe onload event.
 </div>
	<!DOCTYPE html>
	<script>
	function frameLoaded() {
	if (document.counter)
	document.counter++;
	else
	document.counter = 1;

	if (document.counter <= 16) {
	document.designMode='on';
	document.execCommand('selectall');
	document.execCommand('italic');
	}
	}

	if (window.testRunner) {
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	}

	window.addEventListener("load", function() {
	document.getElementById("console").innerText = 'PASS';
	if (window.testRunner)
	testRunner.notifyDone();
	});
	</script>


	<h1><button><iframe></iframe></button>
	</h1><input><iframe onload="frameLoaded()"></iframe>

	<div id="console">FAIL</div>

	<div>
	WebKit bug #<a href="https://bugs.webkit.org/show_bug.cgi?id=132103">132103</a>: Crash applying editing commands from iframe onload event.
	</div>