list-item-without-list-reparented-crash.html

<!DOCTYPE html>

<style>
  p, div, div span {
    display: inline;
  }
  li {
    float: left;
  }
</style>

<script>
onload = function() {
  var span = document.body.querySelector('span');

  var oSelection = window.getSelection();
  oSelection.setBaseAndExtent(span, 0, span, 0);

  var li = document.querySelector('li');
  span.insertBefore(li, span.firstChild);

  document.body.offsetTop;
  if (window.testRunner)
    testRunner.dumpAsText();
  document.write("Test passes if no crash.");
}
</script>

<div>
  <span>x</span>
  <p></p>
  <li></li>
</div>

chromium/third_party/blink/web_tests/fast/lists/list-item-without-list-reparented-crash.html