LayoutTests/editing/execCommand/delete-hidden-crash.html

<!DOCTYPE html>
<html>
<head>
<script src="../editing.js"></script>

<script>
if (window.testRunner)
    testRunner.dumpAsText();

function editingTest() {
    document.execCommand('SelectAll')
    span = document.getElementsByTagName('span')[0];
    span.contentEditable = 'true';
    span.textContent = 'bar';
    document.execCommand('InsertText', false, '1');
    document.body.textContent = "PASS. WebKit didn't crash.";
};
</script>

<style>
* { visibility:visible; }
.inline { display:inline; }
* :only-child { visibility:hidden; }
</style>
</head>
<body onload=editingTest()>
<table>
<tr><td><span><table></table><span></span></span></td></tr>
<tr><td><td style="height: 100px;" class="inline">foo</td></tr>
</table>
</body>
</html>