LayoutTests/editing/inserting/insert-character-in-first-letter-crash.html

<html>
  <head>
    <style>
      #div1 {
        -webkit-text-security: circle;
      }
      #div1::first-letter {
        display: table-row-group;
      }
      #div2 {
        display: table;
      }
      #div2:last-child {
        display: table-row;
      }
    </style>
    <script>
      window.onload = function() {
        var div1 = document.getElementById('div1');
        document.designMode='on';
        document.execCommand('selectall');
        document.execCommand('insertText', false, 'Z');
        document.execCommand('Undo');
        div1.appendChild(document.createElement('div'));
        document.execCommand('selectall');

        document.body.appendChild(document.createTextNode("PASS if no assert or crash in debug."));

        if (window.testRunner)
            testRunner.dumpAsText();
     }
    </script>
  </head>
  <body><div id=div1>AB<div id=div2></div></div></body>
</html>