<!doctype html>
<title>PaymentRequest setting allowpaymentrequest after document creation, before response</title>
<meta name="timeout" content="long">
<script src=/resources/testharness.js></script>
<script src=/resources/testharnessreport.js></script>
<div id="log"></div>
<script>
// Set allowpaymentrequest attribute in a timeout after <iframe> has been inserted to the document.
// The iframe's response is delayed so it happens after the attribute is set.
// The allowpaymentrequest flag is *not* set when the browsing context is created
// (when the <iframe> is inserted), because there's no attribute at that time,
// and the flag stays as not set when the attribute is added because per spec
// the flag is only set when a browsing context is created and when it's navigated.

async_test((t) => {
  const iframe = document.createElement('iframe');
  // no allowpaymentrequest attribute

  const path = location.pathname.substring(0, location.pathname.lastIndexOf('/') + 1);
  iframe.src = "https://{{domains[www1]}}:{{ports[https][0]}}" + path + "echo-PaymentRequest.html?pipe=trickle(d3)";
  iframe.onload = t.step_func(() => {
    iframe.contentWindow.postMessage('What is the result of new PaymentRequest(...)?', '*');
  });

  window.onmessage = t.step_func((e) => {
    // Ignore messages that are not part of the test.
    if (e.source != iframe.contentWindow) return;

    assert_equals(e.data.message, 'Exception');
    assert_equals(4, e.data.details.length);
    // The last entry is the error stacktrace. Ignore it in comparison.
    assert_array_equals(e.data.details.slice(0, 3), [true /* ex instanceof DOMException */, DOMException.SECURITY_ERR, 'SecurityError']);
    t.done();
  });

  document.body.appendChild(iframe);

  setTimeout(() => {
    iframe.allowPaymentRequest = true;
  }, 10);
});
</script>