LayoutTests/editing/inserting/insert-list-then-edit-command-crash.html

<div style="width: 1px; height: 1px;"></div><div contentEditable=true><object data="?" onload=objectOnLoad()></object></div><span>text</span>
<script>
    if (window.testRunner) {
        testRunner.dumpAsText();
        testRunner.waitUntilDone();
    }

    document.getSelection().empty();
    document.execCommand("selectAll", false);

    function objectOnLoad() {
        document.execCommand("insertUnorderedList", false);
        document.execCommand("italic", false);
    }
    
    window.onload = () => {
        requestAnimationFrame(() => {
            setTimeout(() => {
                document.body.innerHTML = "<p> Tests inserting list followed by an edit command. The test passes if WebKit doesn't crash or hit an assertion.</p>";
                testRunner.notifyDone();
            }, 0);
        });
    }
</script>