LayoutTests/fast/editing/modify-selection-list-level-crash.html

<script>
  if (window.testRunner)
      testRunner.dumpAsText();
  onload = () => {
    document.execCommand('SelectAll');
    document.designMode = 'on';
    document.execCommand('InsertNestedOrderedList');
  };
</script>
<slot>
  <li>This test passes if it does not crash.</li>
</slot>
<ol></ol>