chromium/third_party/blink/web_tests/external/wpt/accessibility/crashtests/image-with-detached-text-child.html

<!DOCTYPE html>
<html class="test-wait">
<body>
<div style="display:none">
  <map name="map2">x</map>
</div>
<img usemap="#map2">
<span class=removeme></span>
</body>
<style>
/* The empty declarations are needed to repro the crash */
div + div { }
.doesnotexist + div { }
</style>

<script>
document.addEventListener('DOMContentLoaded', () => {
  requestAnimationFrame(() => {
    requestAnimationFrame(() => {
      document.querySelector('.removeme').remove();
      document.documentElement.className = '';
    });
  });
});
</script>

</html>