chromium/third_party/blink/web_tests/accessibility/table-remove-cell-crash.html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../resources/js-test.js"></script>
</head>
<body>

<table id=table1 tabindex=0><td rowspan=141></table>

<p id="description"></p>
<div id="console"></div>

<script>
    description("This test makes sure we do not crash if javascript removes a cell.");

    if (window.accessibilityController) {
        var table = document.getElementById("table1");
        table.focus();
        tableAX = accessibilityController.focusedElement;

        table.childNodes[0].removeChild(table.childNodes[0].childNodes[0]);

        string = tableAX.attributesOfChildren();
    }
</script>

</body>
</html>