chromium/src/third_party/blink/web_tests/editing/selection/move-node-in-selection-crash.html

<style>
p { position: fixed; height: 1px; }
hgroup { position: fixed; padding-bottom: 1px; padding-left: 100%; -webkit-column-span: all; }
sup { display: -webkit-box; }
</style>
<script>
if (window.testRunner)
  testRunner.dumpAsText();

window.onload = function() {
  document.documentElement.appendChild(document.createElement('span'));
  var grandparent = document.createElement('p');
  document.documentElement.appendChild(grandparent);
  document.execCommand('SelectAll', '');

  grandparent.appendChild(document.createElement('hgroup'));
  var oldParent = document.createElement('span');
  grandparent.appendChild(oldParent);
  var childToMove = document.createElement('sup');
  oldParent.appendChild(childToMove);

  document.body.offsetHeight;

  // Move childToMove under the orphaned parent.
  var orphanedParent = document.createElement('div');
  orphanedParent.appendChild(childToMove);
};
</script>
This is modified from a cluster-fuzz test case. Passes if no crash.