tests/tests/webkitsecurity/assets/crash-on-clear-selection.html

If this doesn't crash, then the test passes.
<div id=foo>foo</div>
<script>
    if (window.layoutTestController)
        layoutTestController.dumpAsText();

    var foo = document.getElementById('foo');
    window.getSelection().selectAllChildren(foo);

    foo.style.display = 'none';
    window.getSelection().removeAllRanges();
</script>