LayoutTests/editing/execCommand/4920742-2.html

<p>This tested for a crash when performing Range::extractContents on a range that has had the start or end removed from the document.</p>
<p>It's now impossible to create a range like this, but at one point with an earlier version of WebKit, it was possible.</p>
<div id="div" contenteditable="true">text <a href="http://www.apple.com/">link</a></div>
<ul id="console"></ul>

<script>
function log(str) {
    var li = document.createElement("li");
    li.appendChild(document.createTextNode(str));
    var console = document.getElementById("console");
    console.appendChild(li);
}

if (window.testRunner)
    window.testRunner.dumpAsText();
    
var div = document.getElementById("div");
var text = div.firstChild;
var link = div.lastChild;
var r = document.createRange();
r.setStart(text, 0);
r.setEnd(link, 0);
text.parentNode.removeChild(text);
r.extractContents();
log("No crash means success!");
</script>