accessibility-node-appendChild-with-detached-parent-crash.html

<body>
PASS if no crash.
<script>
if (window.testRunner)
  testRunner.dumpAsText();

let i = document.createElement('iframe');
document.body.appendChild(i);
let div = document.createElement("div");
i.contentDocument.body.appendChild(div);

i.remove();
div.accessibleNode.appendChild(new AccessibleNode()); 
</script>
</body>

chromium/third_party/blink/web_tests/accessibility/accessibility-node-appendChild-with-detached-parent-crash.html