LayoutTests/editing/selection/undo-crash.html - WebKit - Git at Google

 <html><head>
 <title>Undo crash</title>
 </head>
 <body onload="load()">
 To run this test manually, type some text in the input field, then click the "Crash me" button.
 <input id="testinput" type="text"></input>
 <input id='testbutton' type="button" value="Crash me" onclick="crash()">
 <ul id="console"></ul>
 <script>

 function load()
 {
     document.getElementById('testinput').focus();
     if (window.testRunner)
         testRunner.dumpAsText();
     document.execCommand('InsertText', false, 'b');
     document.execCommand('InsertText', false, 'l');
     document.execCommand('InsertText', false, 'a');
     document.execCommand('InsertText', false, 'h');
     if (eventSender) {
         var button = document.getElementById('testbutton');
         eventSender.mouseMoveTo(button.offsetLeft + 10, button.offsetTop + 5)
         eventSender.mouseDown();
         eventSender.mouseUp();
     }
 }

 function crash()
 {
     var elem = document.getElementById('testinput');
     elem.style.display = 'none';
     document.execCommand('undo');
     log("SUCCEEDED");
 }

 function log(str) {
     var li = document.createElement("li");
     li.appendChild(document.createTextNode(str));
     var console = document.getElementById("console");
     console.appendChild(li);
 }
 </script>
 </body>
 </html>
	<html><head>
	<title>Undo crash</title>
	</head>
	<body onload="load()">
	To run this test manually, type some text in the input field, then click the "Crash me" button.
	<input id="testinput" type="text"></input>
	<input id='testbutton' type="button" value="Crash me" onclick="crash()">
	<ul id="console"></ul>
	<script>

	function load()
	{
	document.getElementById('testinput').focus();
	if (window.testRunner)
	testRunner.dumpAsText();
	document.execCommand('InsertText', false, 'b');
	document.execCommand('InsertText', false, 'l');
	document.execCommand('InsertText', false, 'a');
	document.execCommand('InsertText', false, 'h');
	if (eventSender) {
	var button = document.getElementById('testbutton');
	eventSender.mouseMoveTo(button.offsetLeft + 10, button.offsetTop + 5)
	eventSender.mouseDown();
	eventSender.mouseUp();
	}
	}

	function crash()
	{
	var elem = document.getElementById('testinput');
	elem.style.display = 'none';
	document.execCommand('undo');
	log("SUCCEEDED");
	}

	function log(str) {
	var li = document.createElement("li");
	li.appendChild(document.createTextNode(str));
	var console = document.getElementById("console");
	console.appendChild(li);
	}
	</script>
	</body>
	</html>