rtl-selection-crash.html | Explore in Territory

<meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
<body>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var div = document.createElement('div');
div.contentEditable = 'true';
div.innerHTML = "אחת ש<a id='bar'>תיים </a>שלוש";
document.body.appendChild(div);
div.focus();

var sel = window.getSelection();
sel.selectAllChildren(bar);
var range = sel.getRangeAt(0);
range.insertNode(document.createElement('span'));

// This part can be any number of actions, e.g., clicking anywhere on the page also crashes.
sel.selectAllChildren(bar);
</script>
<p>This test passes if it doesn't crash.</p>
</body>

chromium/third_party/blink/web_tests/editing/text-iterator/rtl-selection-crash.html