rubybase-children-moved-crash-2.html

<!DOCTYPE html>
<style id="style">
.float{float:left;}
.list-item{display:list-item;}
</style>
<p>crbug.com/683104: Passes if it does not crash.</p>
<ruby id="ruby">
  <rb>
    <div class="float list-item"></div>
    Text
    <input class="list-item">
    <rt id="rt" class="list-item">
      <rtc></rtc>
    </rt>
  </rb>
</ruby>
<script>
  if (window.testRunner)
    testRunner.dumpAsText();
  document.body.offsetTop;
  var oElement = document.getElementById("style");
  oElement.insertAdjacentHTML('afterbegin', '<summary><_______ZZ(((P%%%%8</summary>');
  document.execCommand(false);
  var newElement = document.getElementById("rt");
  oElement.parentNode.replaceChild(newElement, oElement)
</script>

chromium/third_party/blink/web_tests/fast/block/float/rubybase-children-moved-crash-2.html