LayoutTests/editing/execCommand/delete-hidden-crash.html - WebKit - Git at Google

 <!DOCTYPE html>
 <html>
 <head>
 <script src="../editing.js"></script>

 <script>
 if (window.testRunner)
     testRunner.dumpAsText();

 function editingTest() {
     document.execCommand('SelectAll')
     span = document.getElementsByTagName('span')[0];
     span.contentEditable = 'true';
     span.textContent = 'bar';
     document.execCommand('InsertText', false, '1');
     document.body.textContent = "PASS. WebKit didn't crash.";
 };
 </script>

 <style>
 * { visibility:visible; }
 .inline { display:inline; }
 * :only-child { visibility:hidden; }
 </style>
 </head>
 <body onload=editingTest()>
 <table>
 <tr><td><span><table></table><span></span></span></td></tr>
 <tr><td><td style="height: 100px;" class="inline">foo</td></tr>
 </table>
 </body>
 </html>
	<!DOCTYPE html>
	<html>
	<head>
	<script src="../editing.js"></script>

	<script>
	if (window.testRunner)
	testRunner.dumpAsText();

	function editingTest() {
	document.execCommand('SelectAll')
	span = document.getElementsByTagName('span')[0];
	span.contentEditable = 'true';
	span.textContent = 'bar';
	document.execCommand('InsertText', false, '1');
	document.body.textContent = "PASS. WebKit didn't crash.";
	};
	</script>

	<style>
	* { visibility:visible; }
	.inline { display:inline; }
	* :only-child { visibility:hidden; }
	</style>
	</head>
	<body onload=editingTest()>
	<table>
	<tr><td><span><table></table><span></span></span></td></tr>
	<tr><td><td style="height: 100px;" class="inline">foo</td></tr>
	</table>
	</body>
	</html>