editing/selection/selection-modify-crash.html

<html>
<head>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

function test()
{
    var htmlElement = document.firstChild;
    // Create a range.
    var staleRange = document.createRange();

    // Delete document.body:
    var range = document.createRange();
    range.setEndAfter(htmlElement);
    range.deleteContents();

    var selection = window.getSelection();
    selection.addRange(staleRange);
    selection.modify("extend", "forward", "documentboundary"); // WebKit crashed here.

    // Recreate the HTML element to show 'PASS'.
    document.appendChild(document.createElement('html'));
    document.firstChild.innerHTML = '<body>PASS</body>';
    if (window.testRunner)
        testRunner.notifyDone();
}
</script>
</head>
<body onload="test()">
</body>
</html>