Add the reported testcase to WPT

The assertion hit has been fixed by the part 7-7 of bug 1774704.  I didn't try
to change any behavior with the patch, however, it stops updating `Selection`
immediately after every DOM tree change.  Therefore I guess that updating
`Selection` at `execCommand("justifyLeft")` may have failed, and it's now
skipped after handling everything, so the DOM tree after calling it must be
changed by the patch (note that we've stopped throwing from
`Document.execCommand`, so failing to handle the command does not cause stopping
the JS).

Differential Revision: https://phabricator.services.mozilla.com/D154050

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1659716
gecko-commit: 4ea96139bf4330f52fe84f27db57d8df840523b5
gecko-reviewers: m_kato

Author: masayuki-nakano

editing/crashtests/forwarddelete-delete-after-justifyleft-indent.html

@@ -0,0 +1,20 @@
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  const fieldset = document.querySelector("fieldset");
+  document.documentElement.contentEditable = true;
+  fieldset.contentEditable = false;
+  document.execCommand("justifyLeft");
+  document.designMode = "on";
+  document.execCommand("indent");
+  document.execCommand("forwardDelete");
+  document.execCommand("delete");
+});
+</script>
+<acronym readonly autofocus>
+<sup>
+<fieldset>
+
+here is fieldset
+</fieldset>
+</acronym>
+</html>