third_party/WebKit/LayoutTests/http/tests/dom/crash-on-querying-event-path.html

   1 <html>
   2 <head>
   3 <script src="/js-test-resources/js-test.js"></script>
   4 </head>
   5 <body>
   6 <script>
   7 var jsTestIsAsync = true;
   8 description('This is a regression test for crbug.com/400476. It should not crash and then brag about it.')
   9
  10 var root = document.documentElement;
  11 var iframe = root.ownerDocument.createElement('iframe');
  12 var timeouts = [];
  13 iframe.onload = iframeOnload;
  14 root.appendChild(iframe);
  15
  16 function iframeOnload() {
  17     var defaultView = iframe.contentDocument.defaultView;
  18     defaultView.onpageshow = onPageShow;
  19     iframe.src = null;
  20     timeouts[timeouts.length] = window.setTimeout(nextIframeLoaded, 100);
  21 }
  22
  23 function onPageShow() {
  24     eventObj = arguments[0];
  25 }
  26
  27 function nextIframeLoaded() {
  28     timeouts.forEach(window.clearTimeout);
  29
  30     // Access of eventObj.path caused the crash.
  31     // The test is somewhat flaky, in that the test may pass as correct
  32     // despite the bug being the code. The exact conditions
  33     // are unclear, but 1, asan helps detect the crash and 2, the
  34     // preceeding gc()s increase the likelihood of it occurring.
  35     gc();
  36     gc();
  37     gc();
  38     gc();
  39     gc();
  40     var path = eventObj.path;
  41     debug(path);
  42
  43     testPassed('totally did not crash.');
  44     finishJSTest();
  45 }
  46 </script>
  47 </body>
  48 </html>