<html>
<script>
window.log = function(message)
{
document.getElementById("log").innerText += message + "\n";
}
function childLoaded()
{
log("Child window loaded.");
window.childWindow.addAndTransferIframe();
}
function start()
{
window.childWindow = window.open("iframe-reparenting-close-window-child.html", "_blank");
window.childWindow.addEventListener("load", childLoaded, false);
}
</script>
<body>
<p>Bug: https://bugs.webkit.org/show_bug.cgi?id=70147</p>
<p>This test recreates scenario when an iframe is reparented from one page to another using 'live iframe transfer'
(with adoptNode() used on the iframe right before re-parenting into the other page's DOM tree).
Then the original page is closed, destroying some internal objects that are associated with the top frame/page/WebVeiw.</p>
<p>In Chromium, this destroys the underlying NotificationPresenter object which is associated with the Page, and as a result, the use of webkitNotification object from JavaScript can crash the browser or return bogus results ('use-after-delete').
Open this test in Chromium and click the button to start the test. If the test doesn't crash, and prints expected results, the bug is not regressed.</p>
<button onclick="start()">Start test</button>
<pre id="log"></pre>
</body>
</html>
Codebase Browser
chromium