moveBefore + range change: layout-tree corruption attempt