chromium/third_party/blink/web_tests/editing/selection/contains-node-crash.html

<!DOCTYPE html>
<html style="display: inline-table">
<script>
if (window.testRunner)
    testRunner.dumpAsText();

window.onload = function() {
    var selection = window.getSelection();
    selection.selectAllChildren(document);
    selection.collapseToEnd();
    var element = document.activeElement;
    document.open();
    document.write("Pass. Test didn't crash.");
    document.close();
    selection.containsNode(element,true);
}
</script>
</html>