range-extract-contents-event-fire-crash.html

<!DOCTYPE html>
<html>
<body>
<p>
    <span>
        <span id="start"></span>
    </span>
</p>
<p>
    <span>
        <span id="end"></span>
    </span>
</p>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function runTest()
{
    document.removeEventListener("DOMSubtreeModified", runTest, false);
    document.body.innerHTML = 'PASS: does not crash';
}

document.addEventListener("DOMSubtreeModified", runTest, false);

var r = document.createRange();
r.setStartBefore(document.getElementById('start'));
r.setEndAfter(document.getElementById('end'));
r.extractContents();
</script>
</body>
</html>

chromium/third_party/blink/web_tests/dom/mutation-event-tests/fast/dom/Range/range-extract-contents-event-fire-crash.html