LayoutTests/editing/undo/5738768.html

<p>This tests for a crash on Undo.  You should see an empty input field below.</p>
<input type="text" id="input">

<script>
if (window.layoutTestController)
    window.layoutTestController.dumpAsText();
document.getElementById("input").focus();
document.execCommand("InsertText", false, "x");
document.execCommand("Undo");
</script>