chromium/src/third_party/blink/web_tests/editing/execCommand/insert-image-on-top-of-directional-text.html

<div>This test uses execCommand('insertImage') to replace the selection in a variety of mixed directionality text.  If this doesn't crash, then the test passes.</div>
<div dir='rtl' id='rtl1' style='white-space:pre' contentEditable>the </div>
<div dir='rtl' id='rtl2' style='white-space:pre' contentEditable>אחת </div>
<div dir='ltr' id='ltr1' style='white-space:pre' contentEditable>the </div>
<div dir='ltr' id='ltr2' style='white-space:pre' contentEditable>אחת </div>
<script>
if (window.testRunner)
     testRunner.dumpAsText();

// Select only "the", not the space, LTR text in RTL region.
document.getSelection().setBaseAndExtent(rtl1.firstChild, 0, rtl1.firstChild, 3);
document.execCommand('InsertImage', false, "../resources/abe.png");
// Select only "אחת", not the space, RTL text in RTL region.
document.getSelection().setBaseAndExtent(rtl2.firstChild, 0, rtl2.firstChild, 3);
document.execCommand('InsertImage', false, "../resources/abe.png");
// Select only "the", not the space, LTR text in LTR region.
document.getSelection().setBaseAndExtent(ltr1.firstChild, 0, ltr1.firstChild, 3);
document.execCommand('InsertImage', false, "../resources/abe.png");
// Select only "אחת", not the space, RTL text in LTR region.
document.getSelection().setBaseAndExtent(ltr2.firstChild, 0, ltr2.firstChild, 3);
document.execCommand('InsertImage', false, "../resources/abe.png");
</script>