third_party/WebKit/LayoutTests/editing/inserting/insert-images-in-pre-x-crash.html

<pre id="x"><x style="white-space: pre-wrap;"><br></x></pre>
<script>

// Adding DOCTYPE, html, or body prevents the crash to reproduce.

if (window.testRunner)
    testRunner.dumpAsText();

var x = document.getElementById("x");
document.execCommand("selectall",false);
document.designMode="on";
document.execCommand("InsertImage");
document.execCommand("InsertImage");
document.execCommand("InsertImage");

document.open();
document.writeln('This test ensures WebKit does not crash.<br><br>PASS');

</script>
</body>
</html>