third_party/WebKit/LayoutTests/fast/storage/storage-detached-iframe.html

   1 <html>
   2   <head>
   3     <script>
   4       function openIframe()
   5       {
   6           if (document.createElement && (iframe = document.createElement('iframe'))) {
   7               document.body.appendChild(iframe);
   8               return iframe;
   9           }
  10       }
  11
  12       function runTestOuterText() {
  13           t1 = openIframe();
  14           var a = t1.contentWindow.frames;
  15           var b = t1.contentDocument.defaultView.localStorage;
  16           var a_localStorage = a.localStorage; // The constructor won't be reachable as window object property after detaching the frame.
  17
  18           t1.outerText = "";
  19           try {
  20                   a_localStorage.fuzz3_visited="test";
  21           } catch (e) {
  22               console.log("Expected exception caught.");
  23           }
  24       }
  25
  26       function runTests() {
  27           runTestOuterText();
  28           document.getElementById("result").innerHTML = "passed";
  29       }
  30
  31       if (window.testRunner)
  32          testRunner.dumpAsText();
  33
  34   </script>
  35   </head>
  36   <body onload="runTests()">
  37     <p>Bug: https://bugs.webkit.org/show_bug.cgi?id=57140
  38     <p>Description: Crash from null pointer dereference below WebCore::StorageAreaImpl::setItem()
  39     <p>Expect: passed
  40     <p>Result: <span id="result">failed</span>
  41   </body>
  42 </html>