insert-html-to-document-element-crash.html

<!DOCTYPE html>
<head>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

onload = function() {
    // Make documentElement to P element without HTML and BODY.
    var htmlElement = document.documentElement;
    var target = document.getElementById('target');
    document.replaceChild(target, htmlElement);

    document.designMode = 'on';
    window.getSelection().collapse(target, 0);
    document.execCommand('InsertHTML', false, '<pre></pre>');

    // Here, document.documentElement is null.
    document.write('PASS if Blink doesn\'t crash.');
};
</script>
</head>
<body>
<p id="target"></p>
</body>
</html>

chromium/third_party/blink/web_tests/editing/execCommand/insert-html-to-document-element-crash.html