aria-owns-destroyed-by-content-replacement.html

<html class="test-wait">
<script>
window.onload = function fuzz() {
  document.querySelector('audio').setAttribute('aria-owns', 'x1');
  requestAnimationFrame(() => {
    document.querySelector('audio').removeAttribute('aria-owns');
    document.documentElement.className = '';
  });
}
</script>
<audio>
  <span id="x1"></span>
</audio>
</html>

chromium/third_party/blink/web_tests/external/wpt/accessibility/crashtests/aria-owns-destroyed-by-content-replacement.html