range-delete-contents-event-fire-crash.html

<!DOCTYPE html>
<html>
<div id="test1">
<input id="test2"/>
<input id="test3"/>
<ol></ol>
</div>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function runTest() {
    var range = document.createRange();
    var test1 = document.getElementById("test1");
    var test2 = document.getElementById("test2");
    var test3 = document.getElementById("test3");
    
    range.setStartBefore(test2);
    range.selectNodeContents(test3);
    range.setEndAfter(test1);
    range.commonAncestorContainer;
    range.deleteContents();
}

document.addEventListener("DOMSubtreeModified", runTest, true);
document.body.appendChild(document.createTextNode("PASS"));
</script>
</html>

chromium/third_party/blink/web_tests/dom/mutation-event-tests/fast/dom/Range/range-delete-contents-event-fire-crash.html