<!DOCTYPE html>
<html>
<body>
<p>This tests changing the password field's type to text while the accessibility tree is turned on. WebKit should not crash.</p> 
<input type="password" value="hello" onmouseup="this.setAttribute('type', 'text')">
<script>
if (!window.accessibilityController) {
    document.write('Click the text input on the left. WebKit should not crash.');
} else {
    testRunner.dumpAsText();
    accessibilityController.enableEnhancedAccessibility(true);
    internals.updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks();
    const input = document.querySelector('input');
    input.type = 'text';
    input.remove();
    document.write('PASS - WebKit did not crash.');
}

</script>
</body>
</html>