From 36d22d82aa202bb199967e9512281e9a53db42c9 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Sun, 7 Apr 2024 21:33:14 +0200
Subject: Adding upstream version 115.7.0esr.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 .../crashtests/activedescendant-crash.html         |  7 ++++
 .../crashtests/aom-in-destroyed-iframe.html        | 27 +++++++++++++++
 .../crashtests/aria-hidden-with-select.html        | 25 ++++++++++++++
 ...aria-owns-destroyed-by-content-replacement.html | 14 ++++++++
 .../crashtests/aria-owns-fallback-content.html     | 19 +++++++++++
 .../crashtests/aria-owns-reparent.html             | 21 ++++++++++++
 .../accessibility/crashtests/aria-owns-select.html | 11 +++++++
 .../accessibility/crashtests/bdo-table-cell.html   | 21 ++++++++++++
 ...omputed-accessible-child-of-pseudo-element.html | 22 +++++++++++++
 .../crashtests/computed-accessible-text-node.html  | 14 ++++++++
 .../crashtests/computed-node-checked.html          | 38 ++++++++++++++++++++++
 .../accessibility/crashtests/computed-node.html    |  8 +++++
 ...ntent-visibility-generated-content-removal.html | 32 ++++++++++++++++++
 .../crashtests/delayed-ignored-change.html         | 19 +++++++++++
 .../crashtests/displaylocked-serialize.html        | 14 ++++++++
 .../crashtests/iframe-owns-child.html              |  2 ++
 .../accessibility/crashtests/iframe-srcdoc.html    |  1 +
 .../accessibility/crashtests/img-map-pseudo.html   | 11 +++++++
 .../crashtests/in-page-link-with-aria-hidden.html  |  2 ++
 .../included-descendant-dom-removal.html           | 27 +++++++++++++++
 .../included-descendant-layout-removal.html        | 28 ++++++++++++++++
 .../crashtests/input-time-datalist.html            |  2 ++
 .../accessibility/crashtests/map-inside-map-2.html | 11 +++++++
 .../accessibility/crashtests/map-inside-map.html   | 16 +++++++++
 .../move-owned-inside-another-owned.html           | 13 ++++++++
 ...ticol-with-text-change-role-relayout-crash.html | 22 +++++++++++++
 .../object-with-unrendered-text-fallback.html      | 11 +++++++
 .../crashtests/serialize-with-no-document.html     |  5 +++
 .../crashtests/slot-assignment-lockup.html         | 34 +++++++++++++++++++
 .../crashtests/svg-mouse-listener.html             | 13 ++++++++
 .../crashtests/table-ignored-child.html            | 18 ++++++++++
 .../crashtests/validation-message.html             |  5 +++
 32 files changed, 513 insertions(+)
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/activedescendant-crash.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/aom-in-destroyed-iframe.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/aria-hidden-with-select.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/aria-owns-destroyed-by-content-replacement.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/aria-owns-fallback-content.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/aria-owns-reparent.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/aria-owns-select.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/bdo-table-cell.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/computed-accessible-child-of-pseudo-element.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/computed-accessible-text-node.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/computed-node-checked.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/computed-node.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/content-visibility-generated-content-removal.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/delayed-ignored-change.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/displaylocked-serialize.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/iframe-owns-child.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/iframe-srcdoc.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/img-map-pseudo.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/in-page-link-with-aria-hidden.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/included-descendant-dom-removal.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/included-descendant-layout-removal.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/input-time-datalist.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/map-inside-map-2.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/map-inside-map.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/move-owned-inside-another-owned.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/multicol-with-text-change-role-relayout-crash.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/object-with-unrendered-text-fallback.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/serialize-with-no-document.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/slot-assignment-lockup.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/svg-mouse-listener.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/table-ignored-child.html
 create mode 100644 testing/web-platform/tests/accessibility/crashtests/validation-message.html

(limited to 'testing/web-platform/tests/accessibility/crashtests')

diff --git a/testing/web-platform/tests/accessibility/crashtests/activedescendant-crash.html b/testing/web-platform/tests/accessibility/crashtests/activedescendant-crash.html
new file mode 100644
index 0000000000..ac0dc5d5ed
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/activedescendant-crash.html
@@ -0,0 +1,7 @@
+<iframe></iframe>
+<script>
+let frame = document.querySelector("iframe");
+window.xyz = frame.contentWindow.accessibilityController.focusedElement;
+frame.remove();
+window.xyz.activeDescendant;
+</script>
diff --git a/testing/web-platform/tests/accessibility/crashtests/aom-in-destroyed-iframe.html b/testing/web-platform/tests/accessibility/crashtests/aom-in-destroyed-iframe.html
new file mode 100644
index 0000000000..d412892983
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/aom-in-destroyed-iframe.html
@@ -0,0 +1,27 @@
+<html class="test-wait">
+<body></body>
+<script>
+  const frameElem = document.createElement('iframe');
+
+  frameElem.srcdoc = '<html><head><title>X</title></head><body><div>-</div></body></html>';
+  frameElem.onload = function() {
+    const frameDoc = frameElem.contentWindow.document;
+
+    const divElem = frameDoc.querySelector('div');
+
+    getComputedAccessibleNode(divElem).then(function(divAccessible) {
+      // Close window.
+      frameElem.remove();
+
+      requestAnimationFrame(() => {
+        // Window removed, but we try to access DOM of non-existent window.
+        const isChecked = divAccessible.checked;
+        // Test is complete.
+        document.documentElement.className = '';
+      });
+    });
+  };
+
+  document.body.appendChild(frameElem);
+</script>
+</html>
diff --git a/testing/web-platform/tests/accessibility/crashtests/aria-hidden-with-select.html b/testing/web-platform/tests/accessibility/crashtests/aria-hidden-with-select.html
new file mode 100644
index 0000000000..2aedbcfb82
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/aria-hidden-with-select.html
@@ -0,0 +1,25 @@
+<html class="test-wait">
+<head>
+<script>
+window.onload = function() {
+  requestAnimationFrame(() => {
+    requestAnimationFrame(() => {
+      document.querySelector('#will-hide').ariaHidden = 'true';
+      document.documentElement.className = '';
+    });
+  });
+};
+</script>
+</head>
+<body>
+<main>
+  <div id="will-hide">
+    <div class="ignored">
+      <select id="select">
+        <option>1</option>
+      </select>
+    </div>
+  </div>
+</main>
+</body>
+</html>
diff --git a/testing/web-platform/tests/accessibility/crashtests/aria-owns-destroyed-by-content-replacement.html b/testing/web-platform/tests/accessibility/crashtests/aria-owns-destroyed-by-content-replacement.html
new file mode 100644
index 0000000000..b64ebaa602
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/aria-owns-destroyed-by-content-replacement.html
@@ -0,0 +1,14 @@
+<html class="test-wait">
+<script>
+window.onload = function fuzz() {
+  document.querySelector('audio').setAttribute('aria-owns', 'x1');
+  requestAnimationFrame(() => {
+    document.querySelector('audio').removeAttribute('aria-owns');
+    document.documentElement.className = '';
+  });
+}
+</script>
+<audio>
+  <span id="x1"></span>
+</audio>
+</html>
diff --git a/testing/web-platform/tests/accessibility/crashtests/aria-owns-fallback-content.html b/testing/web-platform/tests/accessibility/crashtests/aria-owns-fallback-content.html
new file mode 100644
index 0000000000..8a7c9ab6d0
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/aria-owns-fallback-content.html
@@ -0,0 +1,19 @@
+<html class="test-wait">
+<body>
+<div aria-owns="id1"></div>
+<video>
+  <mark>
+    <span id='id1'></span>
+  </mark>
+</video>
+</body>
+<script>
+window.onload = () => {
+  requestAnimationFrame(() => {
+    requestAnimationFrame(() => {
+      document.documentElement.style.display = 'none';
+      document.documentElement.className = '';
+    });
+  });
+}
+</script>
diff --git a/testing/web-platform/tests/accessibility/crashtests/aria-owns-reparent.html b/testing/web-platform/tests/accessibility/crashtests/aria-owns-reparent.html
new file mode 100644
index 0000000000..2eaceb66f6
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/aria-owns-reparent.html
@@ -0,0 +1,21 @@
+<html class="test-wait">
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  requestAnimationFrame(() => {
+    requestAnimationFrame(() => {
+      document.getElementById('owner').setAttribute('aria-owns','x');
+      document.body.setAttribute('aria-hidden', 'true');
+      document.documentElement.className = '';
+    });
+  });
+});
+</script>
+</head>
+<body>
+<p id='owner'></p>
+
+<div>
+  <fieldset id='x'></fieldset>
+</div>
+</body>
+</html>
diff --git a/testing/web-platform/tests/accessibility/crashtests/aria-owns-select.html b/testing/web-platform/tests/accessibility/crashtests/aria-owns-select.html
new file mode 100644
index 0000000000..d6cd094041
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/aria-owns-select.html
@@ -0,0 +1,11 @@
+<script>
+function go(){
+  setup()
+}
+document.addEventListener("DOMContentLoaded", () => {
+  document.querySelector('div').setAttribute('aria-owns','option1')
+});
+</script>
+<div></div>
+<select>
+<option id="option1">
diff --git a/testing/web-platform/tests/accessibility/crashtests/bdo-table-cell.html b/testing/web-platform/tests/accessibility/crashtests/bdo-table-cell.html
new file mode 100644
index 0000000000..ae12541f8d
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/bdo-table-cell.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<link rel="help" href="https://crbug.com/1314808">
+<style>
+item:after { display: block; content: open-quote; }
+item { display: list-item; }
+</style>
+<bdo style="direction:rtl">
+  x<mark></mark>
+</bdo>
+<span style="display: table-cell; column-width: 0px;"></span>
+<script>
+const new_listitem_child = document.createElement('item');
+document.querySelector('mark').appendChild(new_listitem_child);
+</script>
+
+
+<!--
+ax_object.cc(739)] Check failed: child != this. Previous parent still has |this| child:\n
+ERR: "\\"ListMarker\\" axid#14 <::marker> needsToUpdateChildren" should be a child of "\\"ListItem\\" axid#12 <item> needsToUpdateChildren" not of "\\"GenericContainer\\" axid#13 <::after> #children=2"\n
+
+-->
diff --git a/testing/web-platform/tests/accessibility/crashtests/computed-accessible-child-of-pseudo-element.html b/testing/web-platform/tests/accessibility/crashtests/computed-accessible-child-of-pseudo-element.html
new file mode 100644
index 0000000000..5bc1249907
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/computed-accessible-child-of-pseudo-element.html
@@ -0,0 +1,22 @@
+<html class="test-wait">
+<style>
+  h1::before { content: " [before] "; display: table; }
+</style>
+
+<h1>Heading</h1>
+
+<script>
+async function trigger1() {
+  let heading = document.querySelector('h1');
+  let computed_accessible_node = await self.getComputedAccessibleNode(heading);
+  let first_child = computed_accessible_node.firstChild;
+  // The first child of the heading is a pseudo element <table>.
+  await first_child.ensureUpToDate();
+  // The next child down has an accessibility object but no node.
+  let grand_child = first_child.firstChild;
+  await grand_child.ensureUpToDate();
+  document.documentElement.className = '';
+}
+trigger1();
+</script>
+</html>
diff --git a/testing/web-platform/tests/accessibility/crashtests/computed-accessible-text-node.html b/testing/web-platform/tests/accessibility/crashtests/computed-accessible-text-node.html
new file mode 100644
index 0000000000..29b7c2b2fe
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/computed-accessible-text-node.html
@@ -0,0 +1,14 @@
+<html class="test-wait">
+<img id="img1">text
+<script>
+async function trigger1() {
+  let img = document.getElementById('img1');
+  let computed_accessible_node = await self.getComputedAccessibleNode(img);
+  // The next sibling is a text node.
+  let next_sibling = computed_accessible_node.nextSibling;
+  await next_sibling.ensureUpToDate();
+  document.documentElement.className = '';
+}
+trigger1();
+</script>
+</html>
diff --git a/testing/web-platform/tests/accessibility/crashtests/computed-node-checked.html b/testing/web-platform/tests/accessibility/crashtests/computed-node-checked.html
new file mode 100644
index 0000000000..a413d26a01
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/computed-node-checked.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html class="test-wait">
+<body>
+</body>
+<script src="/resources/testharness.js"></script>
+<script>
+if (window.chrome && chrome.gpuBenchmarking) {
+  chrome.gpuBenchmarking.pointerActionSequence(
+    [
+      {
+        source: 'pen',
+        actions: [
+          { name: 'pointerMove', x: 50, y: 50 }
+        ]
+      }
+    ]
+  );
+}
+</script>
+<script>step_timeout(gc, 50);</script>
+<script>
+  const frameElem = document.createElement('iframe');
+
+  frameElem.srcdoc = '<div></div>';
+  frameElem.onload = function() {
+    const frameDoc = frameElem.contentWindow.document;
+    const divElem = frameDoc.querySelector('div');
+    getComputedAccessibleNode(divElem).then(function(divAccessible) {
+      frameElem.remove();
+      requestAnimationFrame(() => {
+        const isChecked = divAccessible.checked;
+        document.documentElement.className = '';
+      });
+    });
+  };
+  document.body.appendChild(frameElem);
+</script>
+</html>
diff --git a/testing/web-platform/tests/accessibility/crashtests/computed-node.html b/testing/web-platform/tests/accessibility/crashtests/computed-node.html
new file mode 100644
index 0000000000..159b217a08
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/computed-node.html
@@ -0,0 +1,8 @@
+<body>
+<iframe></iframe>
+</body>
+<script>
+const iframe = document.querySelector('iframe');
+const option = document.createElement("option");
+iframe.contentWindow.getComputedAccessibleNode(option);
+</script>
diff --git a/testing/web-platform/tests/accessibility/crashtests/content-visibility-generated-content-removal.html b/testing/web-platform/tests/accessibility/crashtests/content-visibility-generated-content-removal.html
new file mode 100644
index 0000000000..b880e244fe
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/content-visibility-generated-content-removal.html
@@ -0,0 +1,32 @@
+<!DOCTYPE HTML>
+<html class="test-wait">
+<style>
+  div { content-visibility: auto; }
+  div::after { content: "Bar" }
+</style>
+<div>Foo</div>
+<div style="height:4000px"></div>
+<script>
+  // Ensure no crash when removing element with generated content after
+  // `content-visibility: auto` content goes out of view.
+  requestAnimationFrame(() => {
+    requestAnimationFrame(() => {
+      // Let one layout run with the div content in view, then
+      // scroll it out of view.
+      document.scrollingElement.scrollTop = 3000;
+
+      // Run three frames to ensure a new layout happens with the
+      // 'auto' content hidden (i.e. layout structures are
+      // destroyed), then remove the div with a pseudo element which
+      // was previously problematic.
+      requestAnimationFrame(() => {
+        requestAnimationFrame(() => {
+          requestAnimationFrame(() => {
+              document.querySelector('div').remove();
+              document.documentElement.className = '';
+          })
+        })
+      })
+    })
+  });
+</script>
diff --git a/testing/web-platform/tests/accessibility/crashtests/delayed-ignored-change.html b/testing/web-platform/tests/accessibility/crashtests/delayed-ignored-change.html
new file mode 100644
index 0000000000..226af19b5f
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/delayed-ignored-change.html
@@ -0,0 +1,19 @@
+<html class="test-wait">
+<style>
+  body { font-size: x-large; }
+  .hidden { visibility: hidden; }
+</style>
+<rb class="hidden">
+  <textarea></textarea>
+</rb>
+<script>
+document.addEventListener('load', () => {
+  window.requestAnimationFrame(() => {
+    window.requestAnimationFrame(() => {
+      document.querySelector('style').remove();
+      document.documentElement.className = '';
+    });
+  });
+}, true);
+</script>
+</html>
diff --git a/testing/web-platform/tests/accessibility/crashtests/displaylocked-serialize.html b/testing/web-platform/tests/accessibility/crashtests/displaylocked-serialize.html
new file mode 100644
index 0000000000..76784291b4
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/displaylocked-serialize.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<link rel=author href="mailto:jarhar@chromium.org">
+<link rel=help href="https://bugs.chromium.org/p/chromium/issues/detail?id=1291169">
+
+<selectmenu></selectmenu>
+<div></div>
+
+<script>
+  (async () => {
+    const selectmenu = document.querySelector('selectmenu');
+    await getComputedAccessibleNode(document.querySelector('div'));
+    selectmenu.style.setProperty('content-visibility', 'hidden');
+  })();
+</script>
diff --git a/testing/web-platform/tests/accessibility/crashtests/iframe-owns-child.html b/testing/web-platform/tests/accessibility/crashtests/iframe-owns-child.html
new file mode 100644
index 0000000000..a318e6aba9
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/iframe-owns-child.html
@@ -0,0 +1,2 @@
+<figure id="fig1"></figure>
+<iframe aria-owns="fig1"></iframe>
diff --git a/testing/web-platform/tests/accessibility/crashtests/iframe-srcdoc.html b/testing/web-platform/tests/accessibility/crashtests/iframe-srcdoc.html
new file mode 100644
index 0000000000..74460048e0
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/iframe-srcdoc.html
@@ -0,0 +1 @@
+<iframe id="frame" style="content-visibility: hidden" srcdoc="\'<table>"</table>\'></iframe>xx
diff --git a/testing/web-platform/tests/accessibility/crashtests/img-map-pseudo.html b/testing/web-platform/tests/accessibility/crashtests/img-map-pseudo.html
new file mode 100644
index 0000000000..443934e431
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/img-map-pseudo.html
@@ -0,0 +1,11 @@
+<source>
+  <map name="map2" class="c1">
+    <dfn class="c8"></dfn>
+  </map>
+</source>
+<img usemap="#map2">
+<style>
+.c1:first-letter { content: "x"; }
+.c8:after { content: "y";  }
+.c1 { float: left;  }
+</style>
diff --git a/testing/web-platform/tests/accessibility/crashtests/in-page-link-with-aria-hidden.html b/testing/web-platform/tests/accessibility/crashtests/in-page-link-with-aria-hidden.html
new file mode 100644
index 0000000000..237707ba07
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/in-page-link-with-aria-hidden.html
@@ -0,0 +1,2 @@
+<p><a href="#dogs">cats</a>
+<p id="dogs" aria-hidden="true">dogs</p>
diff --git a/testing/web-platform/tests/accessibility/crashtests/included-descendant-dom-removal.html b/testing/web-platform/tests/accessibility/crashtests/included-descendant-dom-removal.html
new file mode 100644
index 0000000000..fd978fb45e
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/included-descendant-dom-removal.html
@@ -0,0 +1,27 @@
+<html class="test-wait">
+<head>
+<script>
+window.onload = function() {
+  requestAnimationFrame(() => {
+    requestAnimationFrame(() => {
+      document.querySelector('svg').remove();
+      document.documentElement.className = '';
+    });
+  });
+};
+</script>
+</head>
+<body>
+<div role="group" class="group">
+  <div style="display:none" class="ignored1">
+    <div class="ignored2">
+      <div class="ignored3">
+        <svg>   <!-- Ignored -->
+          <g id="foo"></g>  <!-- Ignored but included in tree -->
+        </svg>
+      </div>
+    </div>
+  </div>
+</div>
+</body>
+</html>
diff --git a/testing/web-platform/tests/accessibility/crashtests/included-descendant-layout-removal.html b/testing/web-platform/tests/accessibility/crashtests/included-descendant-layout-removal.html
new file mode 100644
index 0000000000..5270a36351
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/included-descendant-layout-removal.html
@@ -0,0 +1,28 @@
+<html class="test-wait">
+<head>
+<script>
+window.onload = function() {
+  requestAnimationFrame(() => {
+    requestAnimationFrame(() => {
+      document.querySelector('svg').style.display = 'contents';
+      document.documentElement.className = '';
+    });
+  });
+};
+</script>
+</head>
+<body>
+<div role="group" class="group">
+  <div class="ignored1">
+    <div class="ignored2">
+      <div class="ignored3">
+        <svg role="none">   <!-- Ignored -->
+          <g id="foo"></g>  <!-- Ignored but included in tree -->
+          <circle cx="10" cy="10" r="5" />
+        </svg>
+      </div>
+    </div>
+  </div>
+</div>
+</body>
+</html>
diff --git a/testing/web-platform/tests/accessibility/crashtests/input-time-datalist.html b/testing/web-platform/tests/accessibility/crashtests/input-time-datalist.html
new file mode 100644
index 0000000000..b27b77a767
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/input-time-datalist.html
@@ -0,0 +1,2 @@
+<input type=time list="suggestions">
+<datalist id=suggestions>
diff --git a/testing/web-platform/tests/accessibility/crashtests/map-inside-map-2.html b/testing/web-platform/tests/accessibility/crashtests/map-inside-map-2.html
new file mode 100644
index 0000000000..14ec36c99c
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/map-inside-map-2.html
@@ -0,0 +1,11 @@
+<html>
+  <img usemap="map2" class="img-outside-map">
+  <map name="map2"></map>
+  <script>
+    const img = document.createElement('img');
+    img.className = 'img-inside-map';
+    img.setAttribute('usemap', '#map2');
+    img.style.visibility = 'collapse';
+    document.querySelector('map').appendChild(img);
+  </script>
+</html>
diff --git a/testing/web-platform/tests/accessibility/crashtests/map-inside-map.html b/testing/web-platform/tests/accessibility/crashtests/map-inside-map.html
new file mode 100644
index 0000000000..4ea41fdb3c
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/map-inside-map.html
@@ -0,0 +1,16 @@
+<html>
+  <script>
+    const imgOutsideMap = document.createElement('img');
+    imgOutsideMap.className="img-outside-map";
+    imgOutsideMap.setAttribute('usemap', '#map2');
+    document.documentElement.appendChild(imgOutsideMap);
+    const map = document.createElement('map');
+    map.setAttribute('name', 'map2');
+    document.documentElement.appendChild(map);
+    const imgInsideMap = document.createElement('img');
+    imgInsideMap.className="img-inside-map";
+    imgInsideMap.setAttribute('usemap', '#map2');
+    imgInsideMap.style.visibility = 'collapse';
+    map.appendChild(imgInsideMap);
+  </script>
+</html>
diff --git a/testing/web-platform/tests/accessibility/crashtests/move-owned-inside-another-owned.html b/testing/web-platform/tests/accessibility/crashtests/move-owned-inside-another-owned.html
new file mode 100644
index 0000000000..babe8dcd1d
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/move-owned-inside-another-owned.html
@@ -0,0 +1,13 @@
+<script>
+window.onload = function() {
+  // Reparent z1 under z2.
+  const z2 = document.getElementById('z2');
+  z2.appendChild(document.querySelector('#z1'));
+}
+</script>
+<div aria-owns="z1 z2">
+  <progress>
+    <div id="z1"></div>
+    <div id="z2"></div>
+  </progress>
+</div>
diff --git a/testing/web-platform/tests/accessibility/crashtests/multicol-with-text-change-role-relayout-crash.html b/testing/web-platform/tests/accessibility/crashtests/multicol-with-text-change-role-relayout-crash.html
new file mode 100644
index 0000000000..d1ecd16dcb
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/multicol-with-text-change-role-relayout-crash.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html class="test-wait">
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1278439">
+<div id="container">
+  <div id="mc" style="columns:2; column-fill:auto; width:200px; height:30px; line-height:20px; orphans:1; widows:1;">
+    x<br>
+    x<br>
+  </div>
+</div>
+<script>
+  requestAnimationFrame(()=> {
+    requestAnimationFrame(()=> {
+      requestAnimationFrame(()=> {
+        mc.style.width = "201px";
+        container.setAttribute("role", "treegrid");
+        document.body.offsetTop;
+        document.documentElement.className = "";
+      });
+    });
+  });
+</script>
diff --git a/testing/web-platform/tests/accessibility/crashtests/object-with-unrendered-text-fallback.html b/testing/web-platform/tests/accessibility/crashtests/object-with-unrendered-text-fallback.html
new file mode 100644
index 0000000000..0128213bfc
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/object-with-unrendered-text-fallback.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<style>
+caption:first-letter { color: red; }
+</style>
+
+<object>
+  <table>
+    <caption dir="rtl">)))XX?</caption>
+  </table>
+</object>
+
diff --git a/testing/web-platform/tests/accessibility/crashtests/serialize-with-no-document.html b/testing/web-platform/tests/accessibility/crashtests/serialize-with-no-document.html
new file mode 100644
index 0000000000..f7719cf2ff
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/serialize-with-no-document.html
@@ -0,0 +1,5 @@
+><a>feColorMatrix><div id="container"><0<script>0000A00AAAAA00A<tspan></tspan>000<do>AA0AA0<fieldset></fieldset>A00AA<font><feComponentTransfer></feComponentTransfer><insertedLegend>AAA0A0A0A00A<img>0<link>0A00A0AAAAAA0AAA000A<feDiffuseLighting><mfrac></mfrac><anchor></anchor>00A0<tspan><tspan><tspan><dcol></dcol><missing_glyph></missing_glyph><col></col>0A0AAA0AA0AA0A000A0<mover></mover><form></form><dcol><dcol><dcol><dcol><dcol>&RightTriangleEqual;&triangleq;&boxHd;&blacklozenge;&Sigma;&xodot;&angrtvb;&DScy;&nvDash;&ShortUpArrow;&nvinfin;&LessLess;<math><dt></dt><feTile></feTile>AA0A<isindex></isindex><blockquote>0<mo></mo>AA0A00A00<cursor><desc></desc>AAAA0AA<tref></tref><tref></tref>0AA00AA0<noop></noop><tfoot><insertedLegend></insertedLegend><insertedLegend></insertedLegend><insertedLegend></insertedLegend><insertedLegend></insertedLegend><template></template>00AA00A00AAAAAA00AA<msubsup><legend>0A00AA0A<msub>AA000AAAA<td>0A0AA0A0AA0A000A0AAA<feFlood><ruby>0A000AA00AAAA0AAAA0A<br><feImage>AAA<font>A0000000AAA0AA00<button><video></video>00AA0</div>
+</script><script>
+    var child = new AccessibleNode();
+    container.accessibleNode.appendChild(child);
+</script><a>
diff --git a/testing/web-platform/tests/accessibility/crashtests/slot-assignment-lockup.html b/testing/web-platform/tests/accessibility/crashtests/slot-assignment-lockup.html
new file mode 100644
index 0000000000..85b6c9294a
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/slot-assignment-lockup.html
@@ -0,0 +1,34 @@
+<html class="test-wait">
+<body>
+<script>
+customElements.define("my-detail", class extends HTMLElement {
+  constructor() {
+    super();
+    this.attachShadow({ mode: "open", slotAssignment: "manual" });
+  }
+  connectedCallback() {
+    const slot1 = document.createElement("slot");
+    const child1 = document.createElement("span");
+    this.appendChild(child1);
+    child1.innerHTML = "x";
+    this.shadowRoot.appendChild(slot1);
+    slot1.style.display = "block";
+    slot1.assign(child1);
+  }
+});
+
+function fuzz() {
+  document.designMode = 'on';
+  document.execCommand("selectAll");
+  document.execCommand("InsertText");
+  document.documentElement.className = '';
+}
+window.onload = () => {
+  requestAnimationFrame(() => {
+    requestAnimationFrame(fuzz);
+  });
+};
+</script>
+<my-detail></my-detail>
+</body>
+</html>
diff --git a/testing/web-platform/tests/accessibility/crashtests/svg-mouse-listener.html b/testing/web-platform/tests/accessibility/crashtests/svg-mouse-listener.html
new file mode 100644
index 0000000000..e52909f0f6
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/svg-mouse-listener.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="/resources/testdriver-actions.js"></script>
+<svg viewBox="0 0 500 500">
+    <rect width="500" height="500" id="target" fill="red">
+</svg>
+
+<script>
+document.getElementById("target").addEventListener("click", () => {}, { once: true });
+
+test_driver.click(document.body);
+</script>
diff --git a/testing/web-platform/tests/accessibility/crashtests/table-ignored-child.html b/testing/web-platform/tests/accessibility/crashtests/table-ignored-child.html
new file mode 100644
index 0000000000..99f385f6ea
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/table-ignored-child.html
@@ -0,0 +1,18 @@
+<html>
+<head>
+<script>
+window.onload = function() {
+  document.querySelector('object').appendChild(document.querySelector('#move-me'));
+};
+</script>
+</head>
+<body dir="rtl">
+<object></object>
+<table>
+  <caption style="display:none">
+    <span>
+      <div id="move-me"></div>
+    </span>
+  </caption>
+</table>
+</body>
diff --git a/testing/web-platform/tests/accessibility/crashtests/validation-message.html b/testing/web-platform/tests/accessibility/crashtests/validation-message.html
new file mode 100644
index 0000000000..259c01cd3a
--- /dev/null
+++ b/testing/web-platform/tests/accessibility/crashtests/validation-message.html
@@ -0,0 +1,5 @@
+<html>
+<form><input required><input type=submit id=submit><script>
+submit.click();
+</script>
+</html><!-- Comment required for test to crash -->
-- 
cgit v1.2.3