LayoutTests/fast/events/dispatch-message-string-data.html - WebKit - Git at Google

 <!DOCTYPE html>
 <html>
 <head>
 <p>This is a test for https://bugs.webkit.org/show_bug.cgi?id=71229 (V8MessageEvent::dataAccessorGetter does not return a reference to its caller). If it succeeds, DONE will appear below. If it fails, you should see messages containing unexpected strings that were received and/or a renderer crash.
 <hr>
 <pre id=log></pre>
 <script>
 function log(message)
 {
     document.getElementById("log").innerHTML += message + "<br>";
 }

 var eventTarget;

 // Make a long prefix string. This seems to make it more likely that a use-
 // after-free problem will cause an observable error.
 var kPrefix = "Hello";
 for (var i = 0; i < 10; ++i)
     kPrefix += kPrefix;
 var num = 0;
 var endNum = 1000;
 function HandleMessage(message_event) {
     if (message_event.data !== kPrefix + num.toString()) {
         log("Expected '" + num + "', Got: '" + message_event.data + "'");
     }
     if (num == endNum) {
         testRunner.notifyDone();
     }
     else {
         ++num;
         setTimeout(SendString, 0);
     }
 }

 function SendString() {
     var target = document.getElementById("event_target");
     var message_event = window.document.createEvent('MessageEvent');
     message_event.initMessageEvent('message',  // type
                                    false,  // canBubble
                                    false,  // cancelable
                                    kPrefix + num.toString(),  // data
                                    '',  // origin [*]
                                    '',  // lastEventId
                                    null,  // source [*]
                                    []);  // ports
     target.dispatchEvent(message_event);
 }

 function AddListener() {
     var target = document.getElementById("event_target");
     target.addEventListener("message", HandleMessage, false);
     SendString();
 }
 document.addEventListener("DOMContentLoaded", AddListener, false);

 if (window.testRunner) {
     testRunner.dumpAsText();
     testRunner.waitUntilDone();
 }
 log("DONE");

 </script>
 </head>
 <body>
 <div id="event_target"></div>
 </body>
 </html>
	<!DOCTYPE html>
	<html>
	<head>
	<p>This is a test for https://bugs.webkit.org/show_bug.cgi?id=71229 (V8MessageEvent::dataAccessorGetter does not return a reference to its caller). If it succeeds, DONE will appear below. If it fails, you should see messages containing unexpected strings that were received and/or a renderer crash.
	<hr>
	<pre id=log></pre>
	<script>
	function log(message)
	{
	document.getElementById("log").innerHTML += message + "<br>";
	}

	var eventTarget;

	// Make a long prefix string. This seems to make it more likely that a use-
	// after-free problem will cause an observable error.
	var kPrefix = "Hello";
	for (var i = 0; i < 10; ++i)
	kPrefix += kPrefix;
	var num = 0;
	var endNum = 1000;
	function HandleMessage(message_event) {
	if (message_event.data !== kPrefix + num.toString()) {
	log("Expected '" + num + "', Got: '" + message_event.data + "'");
	}
	if (num == endNum) {
	testRunner.notifyDone();
	}
	else {
	++num;
	setTimeout(SendString, 0);
	}
	}

	function SendString() {
	var target = document.getElementById("event_target");
	var message_event = window.document.createEvent('MessageEvent');
	message_event.initMessageEvent('message', // type
	false, // canBubble
	false, // cancelable
	kPrefix + num.toString(), // data
	'', // origin [*]
	'', // lastEventId
	null, // source [*]
	[]); // ports
	target.dispatchEvent(message_event);
	}

	function AddListener() {
	var target = document.getElementById("event_target");
	target.addEventListener("message", HandleMessage, false);
	SendString();
	}
	document.addEventListener("DOMContentLoaded", AddListener, false);

	if (window.testRunner) {
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	}
	log("DONE");

	</script>
	</head>
	<body>
	<div id="event_target"></div>
	</body>
	</html>