chromium/third_party/blink/web_tests/dom/mutation-event-tests/fast/dom/Range/range-extractContents.html

<!DOCTYPE html>
<html>
<head>
    <script type="text/javascript">
        function log(msg)
        {
            document.body.appendChild(document.createTextNode(msg + '\n'));
        }

        function runTests()
        {
            if (window.testRunner)
                testRunner.dumpAsText();

            document.addEventListener("DOMSubtreeModified", function() {
                document.getElementById('cont').innerHTML = '';
            }, false);

            var r = document.createRange();
            try {
                r.setStartBefore(document.getElementById('start'));
                r.setEndAfter(document.getElementById('end'));
                var fragment = r.extractContents();
            } catch(e) {
            }
            log('PASS: No crash.');
        }

    </script>
</head>
<body onload="runTests();">
    <p id="cont">
        <span>This <span id="start">tests</span></span>
        <span>that we don't crash when mutating the dom during</span>
        <span>an <code id="end">extractContents</code> call.</span>
    </p>
</body>
</html>