chromium/third_party/blink/web_tests/editing/inserting/5549929-1.html

<p>This tests for a crash when inserting into a tab into a tab span that contains a br.  You should no longer be able to get a br inside a tab span while editing but we should still avoid the crash.</p>
<div id="div" contenteditable="true">
<div>foo</div>
<div><span id="span"><br></span></div>
<div>bar</div>

<script>
if (window.testRunner)
    testRunner.dumpAsText();
document.getElementById("div").focus();
span = document.getElementById("span");
window.getSelection().collapse(span, 0);
document.execCommand("InsertText", false, "\t");
</script>