third_party/WebKit/LayoutTests/accessibility/event-on-deleted-iframe-causes-crash.html

   1 <div contenteditable="true">
   2    <span id="item1">Lorem
   3    <br/>
   4    more Lorem!
   5    <blockquote>
   6       ipsum
   7    <span id="item2">
   8 </div>
   9
  10 <script>
  11     if (window.testRunner)
  12         testRunner.dumpAsText();
  13
  14     var s = window.getSelection();
  15     var p1 = document.getElementById("item1");
  16     var p2 = document.getElementById("item2");
  17     s.setBaseAndExtent(p1, 0, p2);
  18     document.execCommand("Indent");
  19
  20     // This code doesn't do anything initially, but the code below creates an iframe
  21     // with the same url as this one, and that time it will delete itself.
  22     var frame = window.parent.document.querySelector('iframe');
  23     if (frame)
  24         frame.remove();
  25 </script>
  26 <script>
  27     // This creates an iframe with the same url as this one, which triggers
  28     // the code above that deletes this iframe, and then triggers a possible crash
  29     // when the execCommand fires accessibility notifications that trigger creation
  30     // of the AXScrollArea corresponding to the frame that's in the process of
  31     // being deleted.
  32     var iframe = document.createElement('iframe');
  33     iframe.src = window.location;
  34     document.body.appendChild(iframe);
  35 </script>