This happens running test accessibility/anonymous-render-block-in-continuation-causes-crash.html with assertions enabled. In ATSPI we always add the list item marker as the first child of the list item, no matter where the marker actually is in the tree.
<rdar://problem/99818534>
Pull request: https://github.com/WebKit/WebKit/pull/4256
Pull request: https://github.com/WebKit/webkit/pull/4268
Committed 254424@main (0357edf07e3b): <https://commits.webkit.org/254424@main> Reviewed commits have been landed. Closing PR #4268 and removing active labels.