crash-removed-iframe.html | Explore in Territory

<html>
<head>
    <title>Crash doing open on destroyed window</title> 
    <script> 
    function testCrash1() {
        var ifr = document.createElement('iframe');
        ifr.onload = function() {
            var win = ifr.contentWindow;
            ifr.parentNode.removeChild(ifr);
            win.open('pantz', '_top');
        };
        document.body.appendChild(ifr);
    }

    // Test with a deconnected iframe.
    function testCrash2() {
        var ifr = document.createElement('iframe');
        ifr.onload = function() {
            var win = ifr.contentWindow;
            ifr.parentNode.removeChild(ifr);
            win.open('pantz', ifr);
        };
        document.body.appendChild(ifr);
    }

    // Test with a new iframe.
    function testCrash3() {
        var ifr = document.createElement('iframe');
        var ifr2 = document.createElement('iframe');
        ifr.onload = function() {
            var win = ifr.contentWindow;
            ifr.parentNode.removeChild(ifr);
            win.open('pantz', ifr2);
        };
        document.body.appendChild(ifr);
    }

    function testCrash() {
        if (window.testRunner)
            testRunner.dumpAsText();

        testCrash1();
        testCrash2();
        testCrash3();
    }
    </script> 
</head>
<body onload="testCrash()">
    <p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=19588">19588</a>: CRASH doing open() on destroyed window</p>
    <p> If this page does not crash the test has passed. </p>
</body>
</html>
chromium/third_party/blink/web_tests/fast/frames/crash-removed-iframe.html
