chromium/third_party/blink/web_tests/editing/selection/extend-over-file-input-by-drag-crash.html

<!DOCTYPE>
<html>
<body>
<p>This test ensures WebKit does not crash when selecting text across an element with type=file.
To manually test, start selection in "start" and extend the selection by dragging to "end" moving across the input element.
WebKit should not crash.</p>
<span id="test">start<input type=file>end</span>
<script>

if (window.testRunner && window.eventSender) {
    testRunner.dumpAsText();

    var test = document.getElementById('test');
    var input = test.getElementsByTagName('input')[0];

    var y = test.offsetTop + test.offsetHeight / 2;
    eventSender.mouseMoveTo(test.offsetLeft + 5, y);
    eventSender.mouseDown();

    eventSender.leapForward(200);
    eventSender.mouseMoveTo(input.offsetLeft + input.offsetWidth / 2, y);
    eventSender.leapForward(200);

    eventSender.mouseMoveTo(test.offsetLeft + test.offsetWidth - 5, y);
    eventSender.mouseDown();

    test.parentNode.removeChild(test);

    document.write('PASS');
}

</script>
</body>
</html>