open-in-body-onload-sync-to-invalid-preflight-handling.html

<!doctype html>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<body onload="openXHR();">
<!-- This embed is necessary to cause the synchronous invocation of onload -->
<embed type="text/html; charset=utf-8">
<script>
const xhr = new XMLHttpRequest();

function openXHR() {
  xhr.open('GET', '/');
  openAndSendCrossOriginNonSimpleXHR();
}

function openAndSendCrossOriginNonSimpleXHR() {
  xhr.open('PUT', 'http://localhost:8000/');
  xhr.send();
}

async_test((test) => {
  // The crash doesn't always happen. Repeat to capture it.
  let count = 10;

  xhr.onerror = test.step_func(() => {
    --count;
    if (count <= 0) {
      test.done();
      return;
    }
    openAndSendCrossOriginNonSimpleXHR();
  });
  openAndSendCrossOriginNonSimpleXHR();
}, 'XMLHttpRequest doesn\'t crash even when open() is invoked ' +
   'synchronously to handling of an invalid preflight response.');

openAndSendCrossOriginNonSimpleXHR();
</script>

chromium/third_party/blink/web_tests/http/tests/xmlhttprequest/open-in-body-onload-sync-to-invalid-preflight-handling.html