chromium/third_party/blink/web_tests/fast/dom/delete-contents.html

<!doctype html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script src="../../editing/assert_selection.js"></script>
<script>
// Deleting the contents of a DOMRange and then inserting a node into it crashes
// in WebCore::Font::canUseGlyphCache
test(() => assert_selection(
    '<div id="mydiv">^01234|</div>',
    selection => {
        const range = selection.getRangeAt(0);
        range.deleteContents();
        range.insertNode(selection.document.createElement('div'));
    },
    '<div id="mydiv">^<div></div>|</div>'),
    'Range#deleteContents() then Range#insertNode() should not crash');
</script>