LayoutTests/fast/frames/crash-removed-iframe.html - WebKit - Git at Google

 <html>
 <head>
     <title>Crash doing open on destroyed window</title>
     <script>
     function testCrash1() {
         var ifr = document.createElement('iframe');
         ifr.onload = function() {
             var win = ifr.contentWindow;
             ifr.parentNode.removeChild(ifr);
             win.open('pantz', '_top');
         };
         document.body.appendChild(ifr);
     }

     // Test with a deconnected iframe.
     function testCrash2() {
         var ifr = document.createElement('iframe');
         ifr.onload = function() {
             var win = ifr.contentWindow;
             ifr.parentNode.removeChild(ifr);
             win.open('pantz', ifr);
         };
         document.body.appendChild(ifr);
     }

     // Test with a new iframe.
     function testCrash3() {
         var ifr = document.createElement('iframe');
         var ifr2 = document.createElement('iframe');
         ifr.onload = function() {
             var win = ifr.contentWindow;
             ifr.parentNode.removeChild(ifr);
             win.open('pantz', ifr2);
         };
         document.body.appendChild(ifr);
     }

     function testCrash() {
         if (window.testRunner)
             testRunner.dumpAsText();

         testCrash1();
         testCrash2();
         testCrash3();
     }
     </script>
 </head>
 <body onload="testCrash()">
     <p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=19588">19588</a>: CRASH doing open() on destroyed window</p>
     <p> If this page does not crash the test has passed. </p>
 </body>
 </html>
	<html>
	<head>
	<title>Crash doing open on destroyed window</title>
	<script>
	function testCrash1() {
	var ifr = document.createElement('iframe');
	ifr.onload = function() {
	var win = ifr.contentWindow;
	ifr.parentNode.removeChild(ifr);
	win.open('pantz', '_top');
	};
	document.body.appendChild(ifr);
	}

	// Test with a deconnected iframe.
	function testCrash2() {
	var ifr = document.createElement('iframe');
	ifr.onload = function() {
	var win = ifr.contentWindow;
	ifr.parentNode.removeChild(ifr);
	win.open('pantz', ifr);
	};
	document.body.appendChild(ifr);
	}

	// Test with a new iframe.
	function testCrash3() {
	var ifr = document.createElement('iframe');
	var ifr2 = document.createElement('iframe');
	ifr.onload = function() {
	var win = ifr.contentWindow;
	ifr.parentNode.removeChild(ifr);
	win.open('pantz', ifr2);
	};
	document.body.appendChild(ifr);
	}

	function testCrash() {
	if (window.testRunner)
	testRunner.dumpAsText();

	testCrash1();
	testCrash2();
	testCrash3();
	}
	</script>
	</head>
	<body onload="testCrash()">
	<p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=19588">19588</a>: CRASH doing open() on destroyed window</p>
	<p> If this page does not crash the test has passed. </p>
	</body>
	</html>