chromium/src/third_party/blink/web_tests/fast/dom/HTMLElement/innerHTML-selection-crash.html

<p>This tests that calling innerHTML doesn't crash when the selection endpoint is inside a text field's shadow DOM tree.</p>

<p>If the test doesn't crash, then it passes.</p>

<input id="field" type="text" value="some text">
<script>

if (window.testRunner)
    testRunner.dumpAsText();

document.getElementById('field').setAttribute('style', 'display: inline');
document.getElementById('field').focus();
document.body.offsetLeft;
document.getElementById('field').setAttribute('style', 'display: block');
document.body.innerHTML;
document.getElementById('field').setAttribute('style', 'display: none');

document.write("<p>PASS: There was no crash.</p>");

</script>