chromium/third_party/blink/web_tests/fast/dom/shadow/drag-to-meter-in-shadow-crash.html

<!DOCTYPE html>
<html>
<body>
<p>This test checks selecting from outside of a shadow tree and to inside of a shadow tree won't crash.</p>
<div id='container' style="width:100px; height: 100px"></div>
<div>PASS</div>
<script src="../../../editing/editing.js"></script>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var container = document.getElementById('container');
var shadowRoot = container.attachShadow({mode: 'open'});
var meter = document.createElement('meter');
shadowRoot.appendChild(meter);

var midX = meter.offsetLeft + (meter.offsetWidth / 2);
var midY = meter.offsetTop + (meter.offsetHeight / 2);
var delta = 40;

eventSender.mouseMoveTo(midX, midY + delta);
eventSender.mouseDown();
eventSender.mouseMoveTo(midX, midY);
eventSender.mouseUp();
</script>
</body>
</html>