ManualTests/selection-drag-crash.html

<html>
<head>
<script>
function selectText() {
    window.getSelection().selectAllChildren(document.body);
}
</script>
</head>
<body onload="selectText()">
<p>
Drag the selected text. It shouldn't crash, though it used to on Chromium Mac since createDragImageForSelection() didn't properly use the return value from dissolveDragImageToFraction(), which resulted in a race condition for the drag image's refcount. This issue can't be tested in an automated manner, due to the fact that the race condition is hard to trigger deterministically and that test_shell/DRT simply don't use the (potentially invalid) image parameter.
</p>
</body>
</html>