editing/selection/replace-selection-crash.html

<html>
    <head>
        <script>
            function test()
            {
                if (window.testRunner)
                    testRunner.dumpAsText();

                document.getElementsByTagName("div")[0].focus();

                var sel = window.getSelection();
                var paragraphs = document.getElementsByTagName("p");
                sel.setBaseAndExtent(paragraphs[0].lastChild, 0, paragraphs[0].lastChild, 2);
                document.execCommand("InsertHTML", false, '<p>No crash!</p>');
                sel.setBaseAndExtent(paragraphs[1].lastChild, 2, paragraphs[1].lastChild, 4);
                document.execCommand("InsertHTML", false, '<p>No crash!</p>');
                sel.setBaseAndExtent(paragraphs[2].lastChild, 4, paragraphs[2].lastChild, 6);
                document.execCommand("InsertHTML", false, '<p>No crash!</p>');
                sel.setBaseAndExtent(paragraphs[3].lastChild, 0, paragraphs[3].lastChild, 6);
                document.execCommand("InsertHTML", false, '<p>No crash!</p>');
            }
        </script>
    </head>
    <body onload="test()">
        <div contenteditable>
            <p><span style="white-space: pre">    </span>select&nbsp;</p>
            <p><span style="white-space: pre">    </span>select&nbsp;</p>
            <p><span style="white-space: pre">    </span>select&nbsp;</p>
            <p><span style="white-space: pre">    </span>select&nbsp;</p>
        </div>
    </body>
</html>