normalize-crash-in-spell-checker.html

<!DOCTYPE html>
<div id="sample" contenteditable="true"></div>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function $(id) { return document.getElementById(id); }

var text1 = document.createTextNode('abc');
var text2 = document.createTextNode(' defg');
var sample = $('sample');
sample.appendChild(text1);
sample.appendChild(text2);
var selection = window.getSelection();
selection.collapse(sample, 0);
selection.extend(sample, 2);
sample.normalize();

if (window.testRunner)
    document.body.textContent = 'PASS; NOT CRASHED';
</script>

chromium/third_party/blink/web_tests/dom/text/normalize-crash-in-spell-checker.html