32 lines
1.3 KiB
HTML
32 lines
1.3 KiB
HTML
<html>
|
|
<script>
|
|
window.log = function(message)
|
|
{
|
|
document.getElementById("log").innerText += message + "\n";
|
|
}
|
|
|
|
function childLoaded()
|
|
{
|
|
log("Child window loaded.");
|
|
window.childWindow.addAndTransferIframe();
|
|
}
|
|
|
|
function start()
|
|
{
|
|
window.childWindow = window.open("iframe-reparenting-close-window-child.html", "_blank");
|
|
window.childWindow.addEventListener("load", childLoaded, false);
|
|
}
|
|
|
|
</script>
|
|
<body>
|
|
<p>Bug: https://bugs.webkit.org/show_bug.cgi?id=70147</p>
|
|
<p>This test recreates scenario when an iframe is reparented from one page to another using 'live iframe transfer'
|
|
(with adoptNode() used on the iframe right before re-parenting into the other page's DOM tree).
|
|
Then the original page is closed, destroying some internal objects that are associated with the top frame/page/WebVeiw.</p>
|
|
<p>In Chromium, this destroys the underlying NotificationPresenter object which is associated with the Page, and as a result, the use of webkitNotification object from JavaScript can crash the browser or return bogus results ('use-after-delete').
|
|
Open this test in Chromium and click the button to start the test. If the test doesn't crash, and prints expected results, the bug is not regressed.</p>
|
|
<button onclick="start()">Start test</button>
|
|
<pre id="log"></pre>
|
|
</body>
|
|
</html>
|