| <!DOCTYPE html> |
| <html> |
| <head> |
| <script src="/js-test-resources/js-test.js"></script> |
| <script> |
| if (window.internals && internals.settings) |
| internals.settings.setShouldRestrictBaseURLSchemes(false); |
| |
| var object; |
| |
| function objectLoad() { |
| object = document.getElementById('object'); |
| |
| object.onbeforeload = () => { |
| object.onbeforeload = null; |
| |
| let base = document.head.appendChild(document.createElement('base')); |
| base.href = 'javascript:///%0aalert("FAIL");//'; |
| finishJSTest(); |
| }; |
| object.data = 'xxxxx'; |
| }; |
| </script> |
| </head> |
| <body> |
| <script> |
| description("Check that forcing a navigation during an object element load is well-behaved.") |
| |
| window.jsTestIsAsync = true; |
| </script> |
| <object id='object' type='text/html' data='http://127.0.0.1:8000/plugins/resources/cross-frame-object-access.html' onload='objectLoad()'> |
| </object> |
| </body> |
| </html> |
