<!doctype html>
<title>PaymentRequest removing allow="payment" after load and then navigating</title>
<script src=/resources/testharness.js></script>
<script src=/resources/testharnessreport.js></script>
<div id="log"></div>
<script>
async_test((t) => {
  const iframe = document.createElement('iframe');
  iframe.allow = "payment";

  let i = 0;

  const path = location.pathname.substring(0, location.pathname.lastIndexOf('/') + 1);
  iframe.src = "https://{{domains[www1]}}:{{ports[https][0]}}" + path + "echo-PaymentRequest.html";
  iframe.onload = t.step_func(() => {
    if (i === 0) {
      // 2. The iframe has now loaded (the first load).
      // The allow="payment" is set.
      iframe.allow = "";
      // 3. The allow attribute has now been cleared.
      // The allow="payment" is *still set* for the document.
    }
    // 4. (first load) Ask the subdocument to invoke PaymentRequest and post back the result.
    // (See below for steps 5 and 6.)
    // 7. (second load) Ask the subdocument to invoke PaymentRequest and post back the result.
    iframe.contentWindow.postMessage('What is the result of new PaymentRequest(...)?', '*');
  });

  window.onmessage = t.step_func((e) => {
    // Ignore messages that are not part of the test.
    if (e.source != iframe.contentWindow) return;

    i++;
    if (i === 1) {
      // 5. This is the first message we receive, from the first load.
      // Since the allow="payment" was set, we expect success.
      assert_equals(e.data.message, 'Success', 'before navigation');

      // 6. Navigate the iframe. This will fire a second 'load' event on the iframe.
      // At this time, the iframe does not have an allow attribute.
      // https://html.spec.whatwg.org/#the-location-interface:dom-location-href-3
      // https://html.spec.whatwg.org/#location-object-setter-navigate
      // https://html.spec.whatwg.org/#location-object-navigate
      // https://html.spec.whatwg.org/#navigate step 12
      // https://html.spec.whatwg.org/#process-a-navigate-response step 5
      // https://html.spec.whatwg.org/#read-html
      // https://html.spec.whatwg.org/#initialise-the-document-object step 8
      // https://html.spec.whatwg.org/#set-the-allow*-flags step 3 does *not* set the allow="payment".
      iframe.contentWindow.location.href = iframe.src + '?2';
    } else {
      // 8. This is the second message we receive, from the second load.
      // Since the allow="payment" was not set, we expect an exception.
      assert_equals(e.data.message, 'Exception', 'after navigation');
      assert_equals(4, e.data.details.length);
      // The last entry is the error stacktrace. Ignore it in comparison.
      assert_array_equals(e.data.details.slice(0, 3), [true /* ex instanceof DOMException*/, 18 /* ex.code */, 'SecurityError' /* ex.name */], 'after navigation');
      t.done();
    }
  });

  // 1. The browsing context for the iframe is created when the iframe is inserted to the document.
  // https://html.spec.whatwg.org/#the-iframe-element:creating-a-new-browsing-context
  // https://html.spec.whatwg.org/#creating-a-new-browsing-context step 11
  // https://html.spec.whatwg.org/#set-the-allow*-flags step 3 sets the allow="payment".
  document.body.appendChild(iframe);
});
</script>