chromium/third_party/blink/web_tests/editing/shadow/breaking-editing-boundaries.html

<!DOCTYPE html>
<html>
<body>
<script src="../../fast/dom/resources/event-sender-util.js"></script>
<script src="../../resources/js-test.js"></script>

<p>When selecting from a child of shadow host to an element in Shadow DOM, a crash should not be caused.
This is because the start position of Selection comes after the end position of Selection.</p>

<p>This test was converted from Shadow DOM v0 to v1, so might not be as applicable with v1.</p>

<div contenteditable>
    before host <span id="host" contenteditable="false">drag from here<span id="target"> </span> after host</span>
</div>
<pre id="console"></pre>

<script>
var shadowRoot = host.attachShadow({mode: 'open'});
shadowRoot.innerHTML = "<span id='shadow-host'>before shadow<shadow id='shadow'></shadow>after shadow</span>"

var nestedShadowHost = shadowRoot.getElementById('shadow-host');
var nestedShadowRoot = nestedShadowHost.attachShadow({mode: 'open'});
nestedShadowRoot.innerHTML = "<span contenteditable>before nested<shadow></shadow>after nested</span>"

// This should not cause a crash.
eventSender.mouseMoveTo(target.offsetLeft - 10, target.offsetTop + target.offsetHeight / 2);
eventSender.mouseDown();
eventSender.mouseMoveTo(nestedShadowHost.offsetLeft + 10, nestedShadowHost.offsetTop + nestedShadowHost.offsetHeight / 2);
eventSender.mouseUp();
debug('PASS');

var successfullyParsed = true;
</script>

</body>
</html>