chromium/content/test/data/accessibility/form-controls/aria-owns-child-and-hidden-descendant-crash.html

<div>
  <b id='child'>
    <span hidden>
      <mark id='hidden-great-grandchild'></mark>
    </span>
  </b>
</div>

<script>
document.addEventListener("DOMContentLoaded", () => {
  document.querySelector('div').setAttribute('aria-owns', 'child hidden-great-grandchild');
});
</script>