chromium/third_party/blink/web_tests/fast/forms/range/range-type-change-onchange.html

<!DOCTYPE html>
<body>
<script src="../../../resources/js-test.js"></script>

<input id="range1" type="range" onchange="updateType(this)">
<script>
description('Check if no problem happens by type change in onchange handler.');

function updateType(input) {
    input.type = 'text';
    setTimeout(finish, 0);
}

function finish() {
    testPassed('unless crash');
    finishJSTest();
}

jsTestIsAsync = true;
document.getElementById('range1').focus();
eventSender.keyDown('ArrowUp');
</script>
</body>