chromium/third_party/blink/web_tests/accessibility/inline-text-word-boundary-causes-crash.html

<html>
<head>
<script src="../resources/js-test.js"></script>
<style>
    h1:first-letter {
        text-transform:uppercase;
    }
</style>
</head>
<body>

    <h1 id="heading">
        heading
    </h1>

<p id="description"></p>
<div id="console"></div>

<script>
description("Makes sure that accessing the word boundaries of an AXStaticText object doesn't cause a crash when it has an inline text box of length zero.");
if (window.accessibilityController) {
    var axHeading = accessibilityController.accessibleElementById('heading');
    var axStaticText = axHeading.childAtIndex(0);
    debug('Word start for index -1: ' + axStaticText.wordStart(-1));
}
</script>   
</body>
</html>