chromium/third_party/blink/web_tests/accessibility/input-file-causes-crash.html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> 
<html>
<head>
<script src="../resources/js-test.js"></script>
</head>
<body>
 
<input id="file-input" style="display:run-in;" type="file"/>
<dl>
 
<p id="description"></p>
<div id="console"></div>
 
<script>
    description("This can cause a crash if AccessibilityRenderObject assumes that a file input element's renderer must be type LayoutFileUploadControl, but in corner cases (display:run-in) this may not be true.");

    if (window.accessibilityController) {
        document.getElementById("file-input").focus();
        var element = accessibilityController.focusedElement;
        var title = element.name;
        shouldBeNonNull("title");
    }
</script>

</body>
</html>