chromium/third_party/blink/web_tests/fast/forms/number/resources/number-spinbutton-crash-on-detach-frame.html

<input id="num1" type="number" value="0">
<script>
var num1 = document.getElementById('num1');
var mouseX = num1.offsetLeft + num1.offsetWidth - 5;
var mouseY = num1.offsetTop + 5;
eventSender.mouseMoveTo(mouseX, mouseY);
eventSender.mouseMoveTo(mouseX, mouseY - 1);
</script>