chromium/third_party/blink/web_tests/fast/ruby/modify-positioned-ruby-text-crash.html

<script>
window.onload = function() {
    var oSelection=window.getSelection();
    document.execCommand("SelectAll", false, false)
    var oRange = oSelection.getRangeAt(0);
    var oDocumentFragment = oRange.extractContents();

    document.body.appendChild(document.createTextNode('PASS, if no assert or crash in debug'));

    if (window.testRunner)
        testRunner.dumpAsText();
}
</script>
<style>
*{word-break:inherit;text-rendering:optimizeLegibility;}
.fixedNavDown{nav-down:#;position:fixed; }
</style>

<ruby><rt class="fixedNavDown">A</rt></ruby>