Discovered when looking at rt testing diffs on metawiki:Diff_(blog)
The content in question there was, <rss max="3" templatename="Diff-RSS">https://diff.wikimedia.org/feed/</rss> which produces span wrapped literal heading tags, which resulted in crashers that required https://gerrit.wikimedia.org/r/c/mediawiki/services/parsoid/+/990630 for T352467
However, the already deployed output differs in TOC content,
https://meta.wikimedia.org/wiki/Diff_(blog)?useparsoid=0&useskin=Vector
vs
https://meta.wikimedia.org/wiki/Diff_(blog)?useparsoid=1&useskin=Vector
A simplified test case could be,
== 1 == == 2 == == 3 == hmmm <ref> <h4> haha </h4> </ref>
The unfortunate consequence of https://gerrit.wikimedia.org/r/c/mediawiki/services/parsoid/+/989618 is that it places the TOC meta inside the extension of the above metawiki page, since the extension content has the first header for findTOCInsertionPoint