[*] POC start
=== Control (Element target): recheck catches reparent ===
  div.firstChild===node1: true
  node1.parentNode===div: true
  node1.parentNode===target: false
  target.firstChild: null
  [+] OK: insertion aborted, no corruption
=== Bug (Document target): recheck bypassed ===
  [+] reentrant fired during ConvertNodeUnionsIntoNodes
  div.firstChild===node1: true
  doc.firstChild===node1: true
  node1.parentNode===doc: true
  div.lastChild: div
  div.childNodes.length: 2
  doc.childNodes.length: 2
  [+] TREE CORRUPTION CONFIRMED: node in two child lists, DCHECK(!target_node->parentNode()) at container_node.cc bypassed
  --- escalation probes ---
  compareDocumentPosition(div,node1): 37
  div.contains(node1): false
  div.contains(trig): false
  div.innerHTML: 41
  div.outerHTML: 52
  div.cloneNode(true): 2
  XMLSerializer(div): 89
  XMLSerializer(doc): 78
  Range.selectNodeContents(div).cloneContents: 2
  Range.selectNodeContents(div).deleteContents threw: NotFoundError: Failed to execute 'deleteContents' on 'Range': The node to be removed is not a child of this node.
  div.normalize: ok
  div.replaceChildren: null
  doc.firstChild.parentNode: null
  doc.replaceChildren: null
[*] POC end