<html> <head> <script> // Document must not have a doctype to trigger the bug function boom() { var root = document.documentElement; while (root.firstChild) { root.removeChild(root.firstChild); } root.contentEditable = "true"; document.removeChild(root); document.appendChild(root); window.getSelection().collapse(root, 0); window.getSelection().extend(document, 1); document.removeChild(root); } </script> </head> <body onload="boom();"></body> </html>