chromium/third_party/blink/web_tests/images/image-page-injected-script-crash.html

<!DOCTYPE html>
<html>
<script>

if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.setPopupBlockingEnabled(false);
    testRunner.waitUntilDone();
}

function log(message)
{
    var console = document.getElementById("console");
    console.appendChild(document.createTextNode(message + "\n"));
}

function zoomPage()
{
    var newwindow = window.open("resources/dice.png");
    newwindow.onload = function() {
       o = newwindow.document.createElement("div");
       o.setAttribute("id", "overlay");
       o.innerHTML = '<form name="testForm" action="" enctype="multipart/form-data" method="get" id="ajaxform" name="pin_form" class="form-horizontal"><input type="text" name="url" id="id_url" /><button id="btnsubmit" type="submit" class="btn btn-primary">Submit</button></form>'; 
       newwindow.document.body.appendChild(o);
	    if (window.eventSender) {
		newwindow.document.forms["testForm"]["url"].value = "some-url";
		newwindow.document.forms["testForm"].submit();

		setTimeout(function(){
		if(newwindow.location.search == "?url=some-url")
			log("Test Success"); 
		else
			log("Test failed: URL passed: " + newwindow.location.search); 			
		testRunner.notifyDone();
		},3000);
		
	   }

    };
}
</script>
<body onload="zoomPage()">
<p>This tests that submitting an injected form on an "image page" doesn't crash the tab. This test requires testRunner to run.  To test manually, open <a href="resources/dice.png">this image</a> in a browser window, and inject script from the page source and fill the form and press submit. It must not crash and the url must have ?url=some-url as the parameter.</p>
<pre id="console"></pre>
</body>
</html>