| <script> |
| if (window.testRunner) { |
| testRunner.waitUntilDone(); |
| testRunner.dumpAsText(); |
| } |
| |
| var haveAddedIFrame = false; |
| |
| window.onbeforeunload = function() { |
| if (!haveAddedIFrame) |
| document.getElementById("logger").innerText += "onbeforeunload called, and iframe hasn't been added yet.\n"; |
| var a = document.createEvent("MouseEvents"); |
| a.initEvent("click", true, true); |
| var d = document.createElement("a"); |
| d.href = "http://localhost:1234/"; |
| d.dispatchEvent(a); |
| } |
| |
| function clicked() { |
| window.location.href="http://127.0.0.1:1234/"; |
| } |
| |
| function addiframe() { |
| document.getElementById("logger").innerText += "Adding iframe.\n"; |
| var frame = document.createElement("iframe"); |
| frame.src = "http://localhost:1234/" |
| document.body.appendChild(frame); |
| haveAddedIFrame = true; |
| if (window.testRunner) |
| testRunner.notifyDone(); |
| } |
| |
| function runTest() { |
| clicked(); |
| setTimeout("addiframe();", 0); |
| } |
| |
| </script> |
| <body onload="runTest();"> |
| This test demonstrates a problem with our handling of the beforeunload event.<br> |
| If a script manages to try and navigate the frame from beforeunload - when a navigation is already pending - we end up blowing out the stack by recursively consulting the policy delegate then running onbeforeunload repeatedly.<br> |
| After this happens, the FrameLoader is in a bogus state where it thinks it is in the middle of a provisional load, but it doesn't have a provisional document loader.<br> |
| In this state, the frame is very difficult to navigate anywhere else, and attempts to load new things within the frame can result in a crash.<br> |
| This was reproducibly identified on sears.com following a bizarre Safari specific code path.<br> |
| <a href="javascript:void(clicked())">Click here to run the beforeunload test and blow out the stack</a><br> |
| <a href="javascript:void(addiframe())">Click here to append an iframe and crash</a><br> |
| <div id="logger"></div> |
| </body> |
