chromium/third_party/blink/web_tests/editing/shadow/breaking-editing-boundaries-2.html

<!DOCTYPE html>
<html>
<body>

<p>When selecting from a child of ShadowRoot to an element outside of shadow host, a crash should not be caused.</p>
<p>To test manually, select from 'before shadow' to 'after host'.</p>

<div id="container" contenteditable>
    <div><p>before host</p></div>
    <div id="host">host</div> 
    <div id="destination">after host</div>
</div>

<script>
if (window.testRunner)
    testRunner.dumpAsText();

var shadowRoot = host.attachShadow({mode: 'open'});
var div = document.createElement('div');
div.setAttribute('contenteditable', 'true');
shadowRoot.appendChild(div);
div.innerHTML = "<div id='source'>before shadow</div><shadow></shadow><div>after shadow</div>";

var nestedShadowRoot = div.attachShadow({mode: 'open'});
nestedShadowRoot.innerHTML = "<div contenteditable>before nested<shadow></shadow>after nested</div>";

var source = shadowRoot.getElementById('source');
var destination = document.getElementById('destination');

if (window.eventSender) {
    eventSender.mouseMoveTo(source.offsetLeft + 20, source.offsetTop + source.offsetHeight / 2);
    eventSender.mouseDown();
    eventSender.mouseMoveTo(destination.offsetLeft + 20, destination.offsetTop + destination.offsetHeight / 2);
    eventSender.mouseUp();

    container.innerHTML = "PASS";
}
</script>
</body>
</html>