chromium/third_party/blink/web_tests/editing/execCommand/replace-crossing-mailblockquote-crash.html

<!DOCTYPE html>
<html><head>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
</head>
<body>
<blockquote type="cite"><div>Three</div></blockquote>
<br>
"bar"
<div id="log"></div>
<script>
test(function () {
    document.designMode = "on";
    document.execCommand("selectAll");
    document.execCommand("InsertHTML", false, "<blockquote type='cite'>Line 2</blockquote><img>");
});
</script>
</body>
</html>