chromium/third_party/blink/web_tests/fast/dom/Range/insertNode-empty-fragment-crash.html

<html>
    <head>
        <script src="../../../resources/js-test.js"></script>
    </head>
    <body>
        <script>
            description('Test Range.insertNode(fragment) when the fragment is empty and the range is collapsed');

            var p = document.createElement('p');
            var t1 = document.createTextNode('12345');
            p.appendChild(t1);
            var t2 = document.createTextNode('ABCDE');
            p.appendChild(t2);
            document.body.appendChild(p);
            var r = document.createRange();
            r.setStart(p, 1);
            r.setEnd(p, 1);
            shouldBeEqualToString("r.toString()", "");

            var df = document.createDocumentFragment();
            r.insertNode(df);

            shouldBe("p.childNodes.length", "2");
            shouldBe("p.childNodes[0]", "t1");
            shouldBe("p.childNodes[1]", "t2");

            shouldBeTrue("r.collapsed");
            shouldBe("r.startContainer", "p");
            shouldBe("r.startOffset", "1");
            shouldBe("r.endContainer", "p");
            shouldBe("r.endOffset", "1");
            shouldBeEqualToString("r.toString()", "")

            document.body.removeChild(p);
        </script>
    </body>
</html>