LayoutTests/editing/execCommand/insert-image-changing-visibility-crash.html

<!DOCTYPE html>
<html>
<head>
<style>
table {
    visibility: collapse;
}

*:only-child {
    visibility: visible;
}
</style>
</head>
<body contenteditable="true">
<script>
window.onload = function () {
    var table = document.getElementById('table');
    table.insertAdjacentHTML('afterbegin', '<svg></svg><div><div id=\'div\'>text</div>');

    var div = document.getElementById('div');
    var selection = window.getSelection();
    selection.collapse(div.firstChild, 0);
    document.execCommand('InsertImage', false, 'about:blank');

    document.write("Passes if it does not crash.");
};

if (window.testRunner)
    testRunner.dumpAsText();
</script>
<table id="table" ></table>
<div></div>
</body>
</html>