range-extract-contents-after-move-to-another-document-crash.html

<!DOCTYPE html>
<html>
<head>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

onload = function() {
    var target = document.getElementById('target');
    var child1 = document.getElementById('c1');
    var child2 = document.getElementById('c2');
    var child3 = document.getElementById('c3');
    document.body.removeChild(target);
    var range = document.createRange();
    range.selectNode(child2)
    target.removeChild(child3);
    var anotherDocument = document.implementation.createDocument('', null);
    anotherDocument.appendChild(target);
    target.appendChild(child1);

    range.extractContents();
    document.body.textContent = 'PASS if Blink doesn\'t crash.';
};
</script>
</head>
<body>
<span id="target">
<b id="c1"></b><div id="c2"></div><input id="c3">
</span>
</body>
</html>

chromium/third_party/blink/web_tests/fast/dom/Range/range-extract-contents-after-move-to-another-document-crash.html