chromium/third_party/blink/web_tests/editing/execCommand/crash-inserting-span.html

<!doctype html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script src="../assert_selection.js"></script>
<div id="log"></div>
<script>
test(() => {
  assert_selection(
    '<div contenteditable><span><a href="foo"><p>^test</p><p>foo<span>bar</span>foo<span>bar</span>.|</p></a></span></div>',
    'insertHTML <span>green</span>',
    '<div contenteditable><span><p><a href="foo">green|</a></p></span></div>');
}, 'Replace the selected tags with span tags');
</script>