If I change the LayoutTests/editing/selection/select-across-readonly-input-1.html as follows:
 <div id="test">
-<input id="from" type="text" value="hello" readonly>
+<input id="from" type="search" value="hello" readonly>
 <span id="to">world</span>
then content_shell crashes:

./out/my_build/content_shell --no-sandbox --run-layout-test $PWD/third_party/WebKit/LayoutTests/editing/selection/select-across-readonly-input-search-1.html
#READY

DevTools listening on ws://127.0.0.1:35205/devtools/browser/b93c0af7-7c09-46ab-9c50-bba41be52f97
[183235:183235:0222/092334.689217:FATAL:TextControlElement.cpp(470)] Check failed: start <= end (4 vs. 0)
#0 0x7fade5e0bbad base::debug::StackTrace::StackTrace()
#1 0x7fade5e09fec base::debug::StackTrace::StackTrace()
#2 0x7fade5e90f3a logging::LogMessage::~LogMessage()
#3 0x7faddde5418a blink::TextControlElement::CacheSelection()
#4 0x7faddde58e07 blink::TextControlElement::SelectionChanged()
#5 0x7faddd9480d1 blink::FrameSelection::NotifyTextControlOfSelectionChange()
#6 0x7faddd947746 blink::FrameSelection::DidSetSelectionDeprecated()
#7 0x7faddd946fe1 blink::FrameSelection::SetSelection()
#8 0x7faddd974fe8 blink::SelectionController::SetNonDirectionalSelectionIfNeeded()
#9 0x7faddd97475d blink::SelectionController::UpdateSelectionForMouseDrag()
#10 0x7faddd9771b1 blink::SelectionController::HandleMouseDraggedEvent()
#11 0x7fadddf003e8 blink::MouseEventManager::HandleMouseDraggedEvent()
#12 0x7fadddeecfe9 blink::EventHandler::HandleMouseMoveOrLeaveEvent()
#13 0x7fadddeec246 blink::EventHandler::HandleMouseMoveEvent()
#14 0x7fadde495857 blink::PageWidgetEventHandler::HandleMouseMove()
#15 0x7fadde49545e blink::PageWidgetDelegate::HandleInputEvent()
#16 0x7fadddb2b8d0 blink::WebViewImpl::HandleInputEventInternal()
#17 0x7fadde495ccf blink::PageWidgetEventHandler::HandleInputEventIncludingTouch()
#18 0x7fadddb2409c blink::WebViewImpl::HandleInputEvent()
#19 0x7fadd9220d5f test_runner::EventSender::HandleInputEventOnViewOrPopup()
#20 0x7fadd92202f4 test_runner::EventSender::ReplaySavedEvents()
#21 0x7fadd921a852 test_runner::EventSender::PointerUp()
#22 0x7fadd9215776 test_runner::EventSenderBindings::MouseUp()
#23 0x7fadd92393c0 _ZN4base8internal13FunctorTraitsIMN11test_runner19EventSenderBindingsEFvPN3gin9ArgumentsEEvE6InvokeIPS3_JS6_EEEvS8_OT_DpOT0_
#24 0x7fadd923931f _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIRKMN11test_runner19EventSenderBindingsEFvPN3gin9ArgumentsEEJPS5_S8_EEEvOT_DpOT0_
#25 0x7fadd92392b1 _ZN4base8internal7InvokerINS0_9BindStateIMN11test_runner19EventSenderBindingsEFvPN3gin9ArgumentsEEJEEEFvPS4_S7_EE7RunImplIRKS9_RKNSt3__15tupleIJEEEJEEEvOT_OT0_NSH_16integer_sequenceImJXspT1_EEEEOSB_OS7_
#26 0x7fadd9239262 _ZN4base8internal7InvokerINS0_9BindStateIMN11test_runner19EventSenderBindingsEFvPN3gin9ArgumentsEEJEEEFvPS4_S7_EE3RunEPNS0_13BindStateBaseESB_S7_
#27 0x7fadd9239206 _ZNKR4base17RepeatingCallbackIFvPN11test_runner19EventSenderBindingsEPN3gin9ArgumentsEEE3RunES3_S6_
#28 0x7fadd9239192 _ZN3gin8internal7InvokerINSt3__116integer_sequenceImJLm0ELm1EEEEJPN11test_runner19EventSenderBindingsEPNS_9ArgumentsEEE18DispatchToCallbackEN4base17RepeatingCallbackIFvS7_S9_EEE
#29 0x7fadd923904d gin::internal::Dispatcher<>::DispatchToCallback()
#30 0x7faddf9f11b2 v8::internal::FunctionCallbackArguments::Call()
#31 0x7faddfaec765 v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
#32 0x7faddfaea859 v8::internal::Builtin_Impl_HandleApiCall()
#33 0x7faddfaea29d v8::internal::Builtin_HandleApiCall()
#34 0x06d2d87046e4 <unknown>