open-in-body-onload-sync-to-invalid-redirect-response-handling.html

<!doctype html>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<body onload="openXHR();">
<!-- This embed is necessary to cause the synchronous invocation of onload -->
<embed type="text/html; charset=utf-8">
<script>
const xhr = new XMLHttpRequest();

function openXHR() {
  xhr.open('GET', '/');
  openAndSendCrossOriginSimpleXHRExpectingRedirect();
}

function openAndSendCrossOriginSimpleXHRExpectingRedirect() {
  xhr.open('GET', 'http://localhost:8000/xmlhttprequest/resources/redirect.php?url=/');
  xhr.send();
}

async_test((test) => {
  // The crash doesn't always happen. Repeat to capture it.
  let count = 10;

  xhr.onerror = test.step_func(() => {
    --count;
    if (count <= 0) {
      test.done();
      return;
    }
    openAndSendCrossOriginSimpleXHRExpectingRedirect();
  });
  openAndSendCrossOriginSimpleXHRExpectingRedirect();
}, 'XMLHttpRequest doesn\'t crash even when open() is invoked synchronously' +
   'to handling of a redirect response to a cross-origin request.');
</script>

chromium/third_party/blink/web_tests/http/tests/xmlhttprequest/open-in-body-onload-sync-to-invalid-redirect-response-handling.html