chromium/third_party/blink/web_tests/accessibility/display-inline-block-crash.html

<html>
<head>
<script src="../resources/js-test.js"></script>
</head>
<body>

<p id="description">This test makes sure that calling childrenCount on
an accessible element doesn't crash under ASAN immediately after switching
that document's display from block to inline-block, due to a bug in
AXLayoutObject::addInlineTextBoxChildren.</p>

<div id="console"></div>

<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

window.jsTestIsAsync = true;

window.addEventListener('load', function() {
    document.body.style.display = "inline-block";
    if (window.accessibilityController)
        accessibilityController.focusedElement.childrenCount;
    finishJSTest();
});
</script>

</body>
</html>