input-events-spin-button-click-on-number-input-delete-document.html

<!DOCTYPE html>
<html>
<head>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/resources/testdriver.js"></script>
<script src="/resources/testdriver-vendor.js"></script>
</head>
<body>
<iframe id="iframe"></iframe>
<script>
promise_test(async function() {
  const child = document.getElementById("iframe");
  const childDocument = child.contentDocument;
  const inputElement = childDocument.createElement('input');
  inputElement.type = "number";
  childDocument.body.appendChild(inputElement);
  let events = [];
  inputElement.addEventListener("beforeinput", () => {
    child.remove();
    events.push("beforeinput");
  });
  inputElement.addEventListener("input", () => {
    events.push("input");
  });
  inputElement.addEventListener("change", () => {
    events.push("change");
  });

  inputElement.focus();
  // Get the spin button up arrow key location and adjust with iframe offset to get absolute position
  const x1 = (inputElement.offsetLeft + inputElement.offsetWidth - 10) + child.offsetLeft;
  const y1 = (inputElement.offsetTop + inputElement.offsetHeight / 4) + child.offsetTop;
  await test_driver_internal.click(inputElement,{x: x1, y: y1});
  assert_array_equals(events, ['beforeinput']);
  assert_false(document.body.contains(child));
}, "Number input should not crash and not fire subsequent events when event handler removes document");
</script>
</body>
</html>

chromium/third_party/blink/web_tests/external/wpt/input-events/input-events-spin-button-click-on-number-input-delete-document.html