iframe-src-change-onload-crash.html

<!DOCTYPE html>
<html>
  <head>
    <script>
      function start() {
        if (window.testRunner) {
          testRunner.dumpAsText();
          testRunner.waitUntilDone();
        }
        iframeElmt = document.createElement('iframe');
        iframeElmt.src = 'resources/empty.xml';
        window.setTimeout('window.top.do_test()', 0);
      }

      function do_test() {
        window.top.cb_onload_count = 0;
        window.top.conce = function() {
          window.top.cb_onload_count++;
          var f = eval('window.top.cb_onload_' + window.top.cb_onload_count);
          if (f) return f(arguments, this);
        };

        iframeElmt.onload = window.top.conce;

        document.body.appendChild(iframeElmt);
      }

      function cb_onload_1() {
        iframeElmt = arguments[1];
        iframeElmt.src = 'javascript:window.top.cb_scriptsrc();';
      }

      function cb_scriptsrc() {
        return 'X';
      }
      
      function cb_onload_2() {
        gc();
        if (window.testRunner) {
          testRunner.notifyDone();
        }
      }
    </script>
  </head>
  <body onload="start()">
    <p>Test PASSES if it does not crash in ASAN builds.</p>
  </body>
</html>
chromium/third_party/blink/web_tests/loader/iframe-src-change-onload-crash.html
