chromium/third_party/blink/web_tests/accessibility/table-destroyed-crash.html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script>
    function createAXObjects(accessibilityObject) {
        var count = accessibilityObject.childrenCount;
        for (var i = 0; i < count; ++i)
            createAXObjects(accessibilityObject.childAtIndex(i));
    }
</script>
<script src="../resources/js-test.js"></script>
</head>
<body id="body">
<table id="table">
  <tr id="row"><td id="cell">foo</td></tr>
  <tr><td>bar</td></tr>
</table>
<script>

    description("This tests that we do not crash when a table is destroyed.");

    if (window.accessibilityController) {
        document.body.focus();
        var body = accessibilityController.focusedElement;
        createAXObjects(body);
    }

    var element = document.getElementById("table");
    element.parentNode.removeChild(element);

</script>

</body>
</html>