LayoutTests/accessibility/accessibility-crash-setattribute.html

<!DOCTYPE HTML>
<html>
<style>
    #div { visibility: collapse }
</style>
<body>
PASS if no crash.
<script>
    if (window.accessibilityController) {
        var largeRange = accessibilityController.accessibleElementById("largeRange");
    }
    if (window.testRunner) {
        testRunner.dumpAsText();
    }
    function eventhandler() {
        document.execCommand("bold", false);
        img.style.removeProperty("-webkit-appearance");
        img.setAttribute("aria-expanded", "false");
    }
</script>
<input id="largeRange" max="100" min="0" type="range" value="50">
<div id="div">
    <dl>
        <canvas>aaa</canvas>
        <img id="img" src="x" style="-webkit-appearance: meter;" onerror="eventhandler()"></img>
    </dl>
</div>
</body>