new webkit_browsertest for crbug.com/103058

content/browser/webkit_browsertest.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/browser.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "content/browser/net/url_request_abort_on_end_job.h"
 #include "content/browser/tab_contents/tab_contents.h"
 
@@ skipping 16 matching lines @@
   ui_test_utils::NavigateToURL(browser(), url);
 
   TabContents* tab_contents = browser()->GetSelectedTabContents();
   // If you are seeing this test fail, please strongly investigate the
   // possibility that http://crbug.com/75604 and
   // https://bugs.webkit.org/show_bug.cgi?id=71122 have reverted before
   // marking this as flakey.
   EXPECT_FALSE(tab_contents->is_crashed());
 }
 
+// This is a browser test because the DumpRenderTree framework holds
+// onto a Document* reference that blocks this reproduction from
+// destroying the Document, so it is not a use after free unless
+// you don't have DumpRenderTree loaded.
+
+// TODO(gavinp): remove this browser_test if we can get good LayoutTest
+// coverage of the same issue.
+const char kXsltBadImportPage[] =
+    "files/webkit/xslt-bad-import.html";
+IN_PROC_BROWSER_TEST_F(WebKitBrowserTest, XsltBadImport) {
+  ASSERT_TRUE(test_server()->Start());
+  URLRequestAbortOnEndJob::AddUrlHandler();
+  GURL url = test_server()->GetURL(kXsltBadImportPage);
+
+  ui_test_utils::NavigateToURL(browser(), url);
+
+  TabContents* tab_contents = browser()->GetSelectedTabContents();
+  EXPECT_FALSE(tab_contents->is_crashed());
+}
+