image-loaded-crash.html | Explore in Territory

<!-- This was found by clusterfuzz. Ensure that
     AXObjectCacheImpl::ImageLoaded doesn't cause a
     crash when called on a LayoutObject for an image
     that's about to be destroyed. -->
<body>
  <base href="#">
  <header><img src='anim.gif'></header>

  <script>
    if (window.testRunner)
      testRunner.dumpAsText();

    let header = document.querySelector('header');

    let img = document.createElement('img'); 
    img.setAttribute('src', 'anim.gif'); 
    header.appendChild(img); 

    // Note: This bug only repros with the deprecated shadow dom v0 API.
    // The crash doesn't happen if you try to switch this to use
    // attachShadow and slot.
    var shadowRoot = header.attachShadow({mode: 'open'});
    var content = document.createElement('span');
    content.setAttribute('select', '.c6');
    shadowRoot.appendChild(content);
    img.setAttribute('class', 'c6'); 
    document.execCommand('');
    img.setAttribute('class', 'c7');
  </script>
</body>

chromium/third_party/blink/web_tests/accessibility/image-loaded-crash.html