insert-paragraph-separator-crash.html

<!DOCTYPE html>
<html>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function handler() {
    var element = event.srcElement;
    document.execCommand('Undo', false, false);
    element.parentNode.removeChild(element);
    var em = document.getElementById('em');
    var span = document.getElementById('span');
    em.insertBefore(element, span);
    document.execCommand('JustifyFull', false, false);
}
document.addEventListener("DOMCharacterDataModified", handler, true);

window.onload = function() {
    var selection = window.getSelection();
    document.execCommand("SelectAll", false, false)
    var element = document.getElementById("ruby");
    element.innerHTML = "<em id='em'>^x?x<span id='span'>x&'x";
    selection.deleteFromDocument();
    selection.deleteFromDocument();
    document.designMode = "on";
    document.execCommand('JustifyRight', false, false);
    document.execCommand('InsertHorizontalRule', false, '');
    document.documentElement.innerHTML = "PASS. WebKit didn't crash.";
};
</script>
<ruby id="ruby">
<a>A</a>
</ruby>
</html>

chromium/third_party/blink/web_tests/dom/mutation-event-tests/editing/inserting/insert-paragraph-separator-crash.html