LayoutTests/accessibility/mac/input-type-change-crash-2.html - WebKit - Git at Google

 <!DOCTYPE html>
 <html>
 <body>
 <p>This tests changing the password field's type to text while the accessibility tree is turned on. WebKit should not crash.</p>
 <input type="password" value="hello" onmouseup="this.setAttribute('type', 'text')">
 <script>
 if (!window.accessibilityController) {
     document.write('Click the text input on the left. WebKit should not crash.');
 } else {
     testRunner.dumpAsText();
     accessibilityController.enableEnhancedAccessibility(true);
     internals.updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks();
     const input = document.querySelector('input');
     input.type = 'text';
     input.remove();
     document.write('PASS - WebKit did not crash.');
 }

 </script>
 </body>
 </html>
	<!DOCTYPE html>
	<html>
	<body>
	<p>This tests changing the password field's type to text while the accessibility tree is turned on. WebKit should not crash.</p>
	<input type="password" value="hello" onmouseup="this.setAttribute('type', 'text')">
	<script>
	if (!window.accessibilityController) {
	document.write('Click the text input on the left. WebKit should not crash.');
	} else {
	testRunner.dumpAsText();
	accessibilityController.enableEnhancedAccessibility(true);
	internals.updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks();
	const input = document.querySelector('input');
	input.type = 'text';
	input.remove();
	document.write('PASS - WebKit did not crash.');
	}

	</script>
	</body>
	</html>