chromium/third_party/blink/web_tests/fast/dom/search-shadow-host-crash.html

<html>
<head>
<script>

if (window.testRunner)
    testRunner.dumpAsText();

function clickOn(element)
{
    if (!window.eventSender)
        return;

    var x = element.offsetLeft + element.offsetWidth / 2;
    var y = element.offsetTop + element.offsetHeight / 2;
    eventSender.mouseMoveTo(x, y);
    eventSender.mouseDown();
    eventSender.mouseUp();
}

function runTest()
{
    clickOn(document.getElementsByTagName('input')[0]);
}

</script>
</head>
<body onload="runTest()">
    <p>Click on the search box. This test passes if does not crash.</p>
    <input type="search" onclick="this.style.display = 'none';">
</body>
</html>