chromium/third_party/blink/web_tests/accessibility/table-modification-crash.html

<html>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();
</script>

<body id="body">

    <!-- This test makes sure we do not crash if javascript changes a table element -->
 
    <table border=1 id='table1'><tr><td>a</td><td>b</td><td>c</td></tr></table>

    <div id="result"></div>
     
    <script>
        if (window.accessibilityController) {
            var result = document.getElementById("result");

            var table = document.getElementById("table1");
            table.focus();
            tableAX = accessibilityController.focusedElement;

            var string = tableAX.attributesOfChildren();

             var row = document.createElement("tr")
             var td1 = document.createElement("td")
             td1.appendChild(document.createTextNode("column 1"))
             row.appendChild(td1);

             var td2 = document.createElement("td")
             td2.appendChild(document.createTextNode("column 2"))
             row.appendChild(td2);

             var td3 = document.createElement("td")
             td3.appendChild(document.createTextNode("column 3"))
             row.appendChild(td3);

             table.childNodes[0].appendChild(row);

             string = tableAX.attributesOfChildren();
 
             table.childNodes[0].removeChild(table.childNodes[0].childNodes[0]);

             string = tableAX.attributesOfChildren();
         
             result.innerText += "Test passed\n";
        }
    </script>
</body>
</html>