third_party/WebKit/LayoutTests/loader/iframe-src-change-onload-crash.html

   1 <!DOCTYPE html>
   2 <html>
   3   <head>
   4     <script>
   5       function start() {
   6         if (window.testRunner) {
   7           testRunner.dumpAsText();
   8           testRunner.waitUntilDone();
   9         }
  10         iframeElmt = document.createElement('iframe');
  11         iframeElmt.src = 'resources/empty.xml';
  12         window.setTimeout('window.top.do_test()', 0);
  13       }
  14
  15       function do_test() {
  16         window.top.cb_onload_count = 0;
  17         window.top.conce = function() {
  18           window.top.cb_onload_count++;
  19           var f = eval('window.top.cb_onload_' + window.top.cb_onload_count);
  20           if (f) return f(arguments, this);
  21         };
  22
  23         iframeElmt.onload = window.top.conce;
  24
  25         document.body.appendChild(iframeElmt);
  26       }
  27
  28       function cb_onload_1() {
  29         iframeElmt = arguments[1];
  30         iframeElmt.src = 'javascript:window.top.cb_scriptsrc();';
  31       }
  32
  33       function cb_scriptsrc() {
  34         return 'X';
  35       }
  36
  37       function cb_onload_2() {
  38         gc();
  39         if (window.testRunner) {
  40           testRunner.notifyDone();
  41         }
  42       }
  43     </script>
  44   </head>
  45   <body onload="start()">
  46     <p>Test PASSES if it does not crash in ASAN builds.</p>
  47   </body>
  48 </html>