xss-XMLHttpRequest-shortcut.html | Explore in Territory

<html>
<head>
    <script>
        if (window.testRunner) {
            testRunner.dumpAsText();
            testRunner.waitUntilDone();
        }

        function onloadForXHRChild() { 
            var targetChild = document.getElementById('targetChild');
            targetChild.src = "resources/targetChild-XMLHttpRequest-shortcut.html";
            targetChild.onload = start;
        }

        function start() {
            var xhrChild = window.frames[1];
            xhrChild.XHR.open('GET', null, true);

            if (window.testRunner)
                testRunner.notifyDone();
        }
    </script>
</head>
<body>
    <p>This tests that frame used when setting eventListeners on an XMLHttpRequest with the shortcut (onreadystatechange), 
       is the requests frame. (rdar://problem/5426142).  This test passes if you don't see an alert dialog with
       the domain of "localhost" in it and an "Unsafe JavaScript" warning is logged to the console.</p>
    <iframe id="targetChild" src=""></iframe>
    <iframe src="resources/childWithXMLHttpRequest.html" onload="onloadForXHRChild();"></iframe>
</body>
</html>

chromium/third_party/blink/web_tests/http/tests/security/listener/xss-XMLHttpRequest-shortcut.html