chromium/third_party/blink/web_tests/fast/dynamic/011.html

<html>
<span id="foo">Bug #3810389.  Make sure we don't crash manipulating blocks inside inlines.  You should see the numbers 1 and 2 vertically stacked below this line. <div>1</div>2</span>
<img>
<script>
document.getElementById('foo').innerHTML = document.body.innerHTML;
</script>
</html>