chromium/third_party/blink/web_tests/paint/invalidation/selection/multiple-body-remove-selection-crash.html

<!DOCTYPE html>
<!-- Passes if doesn't crash -->
<head>
<script>
if (window.testRunner)
  testRunner.dumpAsText();

document.getElementsByTagName('script')[0].remove();
document.addEventListener('selectionchange', function() {
  getSelection().deleteFromDocument();
});
onload = function() {
  var newBody = document.body; 
  // This will create a new <body> and an empty <head>.
  newBody.outerHTML = '';
  newBody.className = 'new-body';
  document.documentElement.insertBefore(newBody, document.head.nextSibling);
  document.execCommand("SelectAll", false);
  document.getElementsByTagName('body')[1].outerHTML = '';
  getSelection().getRangeAt(0).extractContents();
};
</script>
<style>
* { -webkit-appearance: radio }
.new-body { backface-visibility: hidden }
</style>
</head>