chromium/third_party/blink/web_tests/external/wpt/selection/selection-select-all-move-input-crash.html

<script>
  function start() {
    document.execCommand('selectAll', false)
    document.documentElement.appendChild(document.getElementById('input'))
  }
</script>
<body onload="start()">
<input id="input" autofocus>
<canvas contenteditable="true" hidden></canvas>
</body>