LayoutTests/http/tests/security/window-named-valueOf.html - WebKit - Git at Google

 <script>
 if (window.testRunner) {
     testRunner.dumpAsText();
     testRunner.waitUntilDone();
     testRunner.setCanOpenWindows();
     testRunner.setCloseRemainingWindowsWhenComplete(true);
 }
 </script>
 <body>
 This passes if it doesn't alert the contents of innocent-victim.
 <script>
 window.onload = function()
 {
     frame = document.body.appendChild(document.createElement("iframe"));
     frame.src = "http://localhost:8080/security/resources/innocent-victim-with-iframe.html";
     frame.onload = function() {
         frame.onload = null;

         frame.contentWindow[0].location = "data:text/html,<script>(" + function() {
             try {
                 window.name = "valueOf";
                 obj = window.open();
                 obj.__proto__.__proto__ = parent;
                 alert(obj.valueOf.constructor("return document.body.innerHTML")());
             } catch(ex) {
                console.log("Threw exception: " + ex)
             }
             if (window.testRunner)
                 testRunner.notifyDone();
         } + ")()</scr" + "ipt>";
     }
 }
 </script>
	<script>
	if (window.testRunner) {
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	testRunner.setCanOpenWindows();
	testRunner.setCloseRemainingWindowsWhenComplete(true);
	}
	</script>
	<body>
	This passes if it doesn't alert the contents of innocent-victim.
	<script>
	window.onload = function()
	{
	frame = document.body.appendChild(document.createElement("iframe"));
	frame.src = "http://localhost:8080/security/resources/innocent-victim-with-iframe.html";
	frame.onload = function() {
	frame.onload = null;

	frame.contentWindow[0].location = "data:text/html,<script>(" + function() {
	try {
	window.name = "valueOf";
	obj = window.open();
	obj.__proto__.__proto__ = parent;
	alert(obj.valueOf.constructor("return document.body.innerHTML")());
	} catch(ex) {
	console.log("Threw exception: " + ex)
	}
	if (window.testRunner)
	testRunner.notifyDone();
	} + ")()</scr" + "ipt>";
	}
	}
	</script>