<html>
<head>
<script>
window.onload = function()
{
    if (window.testRunner) {
        testRunner.dumpAsText();
        testRunner.waitUntilDone();
    }

    function alertMsg(msg) { 
        return "javascript:alert(\"FAIL: " + msg + 
            "\");document.body.innerHTML=\"<p style='font-weight:bold;color:red'>Failure testing " + msg + "</p>\";//"; 
    }
    // Test different ways of setting iframe.src
    var aliasTests = [
        // Attr/Node attributes
        function(iFrame) { iFrame.attributes['src'].value = alertMsg("value"); iFrame.src = iFrame.src;},
        function(iFrame) { iFrame.attributes['src'].textContent = alertMsg("textContent");},
        function(iFrame) { iFrame.attributes['src'].nodeValue = alertMsg("nodeValue");},
        
        // Text Node Manipulation
        function(iFrame) { iFrame.attributes['src'].firstChild.data = alertMsg("nodeValue");},

        // Node attribute manipulation functions
        function(iFrame) { iFrame.setAttribute("src", alertMsg("setAttribute"));},
        function(iFrame) { iFrame.setAttributeNS(null, "src", alertMsg("setAttributeNS"));},
        function(iFrame) {
            var a = document.createAttribute('src');
            a.nodeValue = alertMsg("setAttributeNode");
            iFrame.setAttributeNode(a);
        },
        function(iFrame) {
            var a = document.createAttribute('src');
            a.nodeValue = alertMsg("setAttributeNodeNS");
            iFrame.setAttributeNodeNS(a);
        },
        // Child manipulation methods
        function(iFrame) { 
            var src = iFrame.attributes['src'];
            src.appendChild(document.createTextNode(alertMsg("appendChild() + removeChild()")));
            src.removeChild(src.firstChild);
        },
        function(iFrame) { 
            var src = iFrame.attributes['src'];
            src.replaceChild(document.createTextNode(alertMsg("replaceChild()")), src.firstChild);
        },
        function(iFrame) { 
            var src = iFrame.attributes['src'];
            while (src.firstChild)
                src.removeChild(src.firstChild);
            src.appendChild(document.createTextNode(alertMsg("removeChild() + appendChild()")));
        },
        function(iFrame) { 
            var src = iFrame.attributes['src'];
            while (src.firstChild)
                src.removeChild(src.firstChild);
            var msg = alertMsg("removeChild() + appendChild() + appendChild()");
            src.appendChild(document.createTextNode(msg.slice(0,4)));
            src.appendChild(document.createTextNode(msg.slice(4)));
        },
        function(iFrame) { 
            var src = iFrame.attributes['src'];
            src.insertBefore(document.createTextNode(alertMsg("insertBefore()")), src.firstChild);
        },
        // NamedNodeMap
        function(iFrame) {
            var a = document.createAttribute('src');
            a.nodeValue = alertMsg("setNamedItem()");
            iFrame.attributes.setNamedItem(a);
        },
        function(iFrame) {
            var a = document.createAttribute('src');
            a.nodeValue = alertMsg("setNamedItemNS()");
            iFrame.attributes.setNamedItemNS(a);
        }
    ];

    var testIndex = 0;

    function makeOnloadHandler (idx, tgtFrame) {
        return function() {
            tgtFrame.onload = null;
            try {
                aliasTests[idx](tgtFrame);
            } catch (e) {}
            if (testIndex < aliasTests.length)
                nextTest();
            else if (window.testRunner)
                testRunner.notifyDone();
        }
    }

    function nextTest() {
        var aFrame = document.createElement('iframe');
        aFrame.src = 'http://localhost:8080/security/resources/innocent-victim.html';
        aFrame.onload = makeOnloadHandler(testIndex++, aFrame);
        aFrame.width = 700;
        aFrame.height = 40;
        document.body.appendChild(aFrame);
        document.body.appendChild(document.createElement('br'));
    }
    
    nextTest();
}

</script>
</head>
<body>
<p>This script tests if iframe.src can be set to a JavaScript URL via alternate 
   DOM interfaces (such as Node.textContent or NamedNode.setNamedItem). 
   The test is successful if no alerts appear and the page finishes loading.</p>
</body>
</html>