chromium/third_party/blink/web_tests/fast/forms/range/slider-inline-crash.html

<!DOCTYLE html>
<html>
<style>
input[type="range"]::-webkit-slider-container,
input[type="range"]::-webkit-slider-runnable-track,
input[type="range"]::-webkit-slider-thumb {
    display: inline;
}
</style>
<p>This test passes if dragging the thumb does not crash.</p>
<input id="slider" type="range">
<script>
function runTest()
{
    if (!window.testRunner || !window.eventSender)
        return;
    testRunner.dumpAsText();

    var slider = document.getElementById("slider");
    var x = slider.offsetLeft + slider.offsetWidth / 2;
    var y = slider.offsetTop + slider.offsetHeight / 2;
    eventSender.mouseMoveTo(x, y);
    eventSender.mouseDown();
    eventSender.mouseUp();
}

runTest();
</script>
</html>