third_party/WebKit/LayoutTests/http/tests/security/window-named-proto.html

   1 <script>
   2 if (window.testRunner) {
   3     testRunner.dumpAsText();
   4     testRunner.waitUntilDone();
   5 }
   6
   7 window.onload = function()
   8 {
   9     frame = document.body.appendChild(document.createElement("iframe"));
  10     frame.src = "http://localhost:8080/security/resources/innocent-victim-with-iframe.html";
  11     frame.onload = function() {
  12         frame.onload = null;
  13
  14         frame.contentWindow[0].location = "data:text/html,<script>(" + function() {
  15
  16             setTimeout(function() {
  17                 if (window.testRunner)
  18                     testRunner.notifyDone();
  19             }, 0);
  20
  21             window.name = "__proto__";
  22             parent.__proto__.alert.constructor("alert(document.body.innerHTML)")();
  23         } + ")()</scr" + "ipt>";
  24     }
  25 }
  26 </script>