chromium/third_party/blink/web_tests/accessibility/insert-adjacent-html-causes-crash.xhtml

<!-- This document must be xhtml for the crash to occur -->
<li xmlns="http://www.w3.org/1999/xhtml">
  <h1 id="x">x<h1></h1></h1>
  <script><![CDATA[
    if (window.testRunner)
      testRunner.dumpAsText();

    // Calling accessibleElementById on a nonexistant id has the side effect
    // of creating an accessibility object for every node in the tree.
    if (accessibilityController)
      accessibilityController.accessibleElementById('dummy');

    // Calling insertAdjacentHTML causes the cached parent of an
    // AXLayoutObject to be invalid after the next layout.
    x=document.getElementById("x");
    x.insertAdjacentHTML("beforebegin", "text");

    // Force layout.
    x.offsetTop;

    // Explore the accessibility tree again, triggering the crash if
    // the cached parent isn't updated correctly.
    if (accessibilityController)
      accessibilityController.accessibleElementById('dummy');
  ]]></script>
</li>