| <html> |
| <script> |
| window.log = function(message) |
| { |
| document.getElementById("log").innerText += message + "\n"; |
| } |
| |
| function childLoaded() |
| { |
| log("Child window loaded."); |
| window.childWindow.addAndTransferIframe(); |
| } |
| |
| function start() |
| { |
| window.childWindow = window.open("iframe-reparenting-close-window-child.html", "_blank"); |
| window.childWindow.addEventListener("load", childLoaded, false); |
| } |
| |
| </script> |
| <body> |
| <p>Bug: https://bugs.webkit.org/show_bug.cgi?id=70147</p> |
| <p>This test recreates scenario when an iframe is reparented from one page to another using 'live iframe transfer' |
| (with adoptNode() used on the iframe right before re-parenting into the other page's DOM tree). |
| Then the original page is closed, destroying some internal objects that are associated with the top frame/page/WebVeiw.</p> |
| <p>In Chromium, this destroys the underlying NotificationPresenter object which is associated with the Page, and as a result, the use of webkitNotification object from JavaScript can crash the browser or return bogus results ('use-after-delete'). |
| Open this test in Chromium and click the button to start the test. If the test doesn't crash, and prints expected results, the bug is not regressed.</p> |
| <button onclick="start()">Start test</button> |
| <pre id="log"></pre> |
| </body> |
| </html> |
