update-plugin-after-detachment-crash.html

<!DOCTYPE html>
<script src = "../../resources/testharness.js"></script>
<script src = "../../resources/testharnessreport.js"></script>
<script>
var t = async_test("Don't reuse disposed FrameView for <embed>");

onload = t.unreached_func("window load should not fire before embed load");

function embedLoaded() {
  document.querySelector('iframe').srcdoc = "data:text/html,bar";

  var embed = document.querySelector('embed');
  embed.align = "right";
  embed.height = "28";
  embed.type = "foo";

  var docLoaded = false;
  onload = t.step_func(function () {
    var object = document.createElement("object");
    // Trying to access a named property on <object> will run post layout tasks
    // synchronously from HTMLPluginElement::layoutPartForJSBindings(). Make sure
    // it doesn't try to re-load a persisted FrameView for a detached frame.
    object.whatever = "anything";

    docLoaded = true;
  });

  // This will cause detach the embed and iframe element, which will cause the
  // window load event to fire, since all loading subframes will have been
  // detached.
  document.body.remove();

  t.step(function() {
    assert_true(docLoaded, "document onload should already be done synchronously within the above innerText change.");
    // Getting here without crashing implies the test passed.
    t.done();
  });
};
</script>
<embed onload="embedLoaded()" src="foo"></embed>
<iframe></iframe>
chromium/third_party/blink/web_tests/fast/plugins/update-plugin-after-detachment-crash.html
