chromium/third_party/blink/web_tests/http/tests/security/cross-origin-OffscreenCanvas2D-transferToImageBitmap.html

<!DOCTYPE html>
<html>
<body>
<canvas id='output' width='200' height='400'></canvas>
<script src="/js-test-resources/js-test.js"></script>
<script>
description("A tainted imagebitmap drawn to OffscrenCanvas cannot be transfered");

window.jsTestIsAsync = true;

var image = document.createElement('img');
image.src = 'http://localhost:8080/security/resources/abe.png';
image.addEventListener('load', function() {
    createImageBitmap(image, 0, 0, 10, 10).then(
        function(originalImagebitmap) {
            const aCanvas = new OffscreenCanvas(200, 400);
            const ctx = aCanvas.getContext('2d');
            // Draw a tainted imagebitmap into OffscreenCanvas 2d
            ctx.drawImage(originalImagebitmap, 0, 0, 10, 10);
            const newImageBitmap = aCanvas.transferToImageBitmap();
            try {
                window.postMessage(newImageBitmap, [newImageBitmap]);
                testFailed("A tainted ImageBitmap cannot be transferred");
                finishJSTest();
            } catch (e) {
                testPassed("A tainted ImageBitmap cannot be transferred");
                finishJSTest();
            }
        }).catch((e) => {
            testFailed("Image rejected unexpectedly. ");
            debug(e);
        });
    });
</script>
</body>
</html>