third_party/WebKit/LayoutTests/fast/loader/unload-mutation-crash.html

   1 <script>
   2 if (window.testRunner)
   3     window.testRunner.dumpAsText();
   4
   5 function start() {
   6   window.firstFrame = document.createElement('iframe');
   7   document.body.appendChild(window.firstFrame);
   8   window.secondFrame = document.createElement('iframe');
   9   window.secondFrame.src = 'javascript:window.top.maybeStart();';
  10   window.firstFrame.contentDocument.documentElement.appendChild(window.secondFrame);
  11 }
  12
  13 function maybeStart() {
  14   window.secondFrame.contentWindow.onunload = function() {
  15     document.documentElement.removeChild(window.bodyEl);
  16   };
  17
  18   window.firstFrame.src = 'javascript:"";';
  19   console.log("PASS unless crash.");
  20 }
  21 </script>
  22 <body id=bodyEl onload=start()></body>
  23 </html>