<body onmouseup="handleMouseUp()">
This tests for a crash when clicking on a page after an input element with a selection inside of it disappears.  To run it manually, just click on this text (a selection has already been placed inside a disappearing text field).<br>
<input type="text" id="input" value="value"><br>
<ul id="console"></ul>
</body>

<script>
function log(msg) {
    console = document.getElementById("console");
    li = document.createElement("li");
    text = document.createTextNode(msg);
    console.appendChild(li);
    li.appendChild(text);
}
function handleMouseUp() {
    log("Success!");
}

if (window.testRunner)
    window.testRunner.dumpAsText();
    
input = document.getElementById("input");
input.setSelectionRange(0, 1);
input.style.display = "none";

if (window.testRunner) {
    eventSender.mouseMoveTo(50, 50);
    eventSender.mouseDown();
    eventSender.mouseUp();
}
</script>