object-image-error-with-onload.html

<html>
<body> 
<p>
Test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=19891">Bug https://bugs.webkit.org/show_bug.cgi?id=19891</a></i>
Broken HTML object elements cause de-reference of pointer to freed memory
</p>
<object id=target codetype="image/gif" height="10"></object>
Pass if there is no crash or ASSERT.

<script>
const target = document.getElementById("target");
if (window.testRunner) {
  testRunner.dumpAsText();
  testRunner.waitUntilDone();
  target.onerror = () => testRunner.notifyDone();
}
// Ensure to install an onload handler before setting data to avoid
// cases where the event is fired before the handler is in place.
target.data = "this.object.does.not.exist.gif";
</script>
</body>
</html>

chromium/third_party/blink/web_tests/http/tests/misc/object-image-error-with-onload.html