chromium/third_party/blink/web_tests/fast/dom/shadow/shadow-dom-anchor-click-crash.html

<!DOCTYPE html>
<html>
<head>
<title>Shadow DOM click inside anchor crash </title>
<script src="../../../resources/testharness.js"></script>
<script src="../../../resources/testharnessreport.js"></script>
</head>
<body>
  <!-- [Bug 1029197], https://crbug.com/1029197 -->
  <!-- [Shadow]: Inside a scoped event, Clicking on a inline element embedded in anchor that's -->
  <!-- placed inside shadow DOM causes crash.  -->
  <div id="host"></div>
  <script>
    async_test(t => {
      let sr = host.attachShadow({mode: "open"});
      sr.innerHTML = '<a href="#"><span id="target">text</span></a>';

      document.addEventListener("selectstart", t.step_func_done(() => {
        // trigger a click event inside another scoped event.
        sr.getElementById('target')
          .dispatchEvent(new MouseEvent('click', {
            bubbles: true,
            composed: false
          }));
      })) ;
      document.execCommand("SelectAll");
    }, "No Crash");
  </script>
</body>
</html>