| This test demonstrates a problem with our handling of the beforeunload event. |
| If a script manages to try and navigate the frame from beforeunload - when a navigation is already pending - we end up blowing out the stack by recursively consulting the policy delegate then running onbeforeunload repeatedly. |
| After this happens, the FrameLoader is in a bogus state where it thinks it is in the middle of a provisional load, but it doesn't have a provisional document loader. |
| In this state, the frame is very difficult to navigate anywhere else, and attempts to load new things within the frame can result in a crash. |
| This was reproducibly identified on sears.com following a bizarre Safari specific code path. |
| Click here to run the beforeunload test and blow out the stack |
| Click here to append an iframe and crash |
| onbeforeunload called, and iframe hasn't been added yet. |
| Adding iframe. |
| |
