Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/accessibility/adopt-node-causes-crash.html 

<!DOCTYPE html>
<script src="../resources/js-test.js"></script>

<!-- Nodes inside a canvas get an AXNodeObject, not an AXLayoutObject. -->
<canvas>
    <div id=node2></div>
</canvas>

<script>
    description("Ensure that if we have an AXNodeObject with a raw pointer to a Node, the accessible object gets correctly detached if we adopt the node into a new document.");

    // This triggers an asynchronous accessibility notification.
    document.getElementById("node2").setAttribute("aria-label", "Label");

    // Adopt the node into a new document, then garbage-collect it.
    // Make sure the notification doesn't try to access the invalid node.
    document.implementation.createDocument("", null).adoptNode(node2);
    gc();
</script>