new webkit_browsertest for crbug.com/103058

content/browser/webkit_browsertest.cc

Index: content/browser/webkit_browsertest.cc
diff --git a/content/browser/webkit_browsertest.cc b/content/browser/webkit_browsertest.cc
index 1d6dea8df9a685ca8b0b16f30fdb87a400bf0c0a..17a3376b771f11308b4a231601542e43e6b2f5e9 100644
--- a/content/browser/webkit_browsertest.cc
+++ b/content/browser/webkit_browsertest.cc
@@ -34,3 +34,23 @@ IN_PROC_BROWSER_TEST_F(WebKitBrowserTest, AbortOnEnd) {
   EXPECT_FALSE(tab_contents->is_crashed());
 }
 
+// This is a browser test because the DumpRenderTree framework holds
+// onto a Document* reference that blocks this reproduction from
+// destroying the Document, so it is not a use after free unless
+// you don't have DumpRenderTree loaded.
+
+// TODO(gavinp): remove this browser_test if we can get good LayoutTest
+// coverage of the same issue.
+const char kXsltBadImportPage[] =
+    "files/webkit/xslt-bad-import.html";
+IN_PROC_BROWSER_TEST_F(WebKitBrowserTest, XsltBadImport) {
+  ASSERT_TRUE(test_server()->Start());
+  URLRequestAbortOnEndJob::AddUrlHandler();
+  GURL url = test_server()->GetURL(kXsltBadImportPage);
+
+  ui_test_utils::NavigateToURL(browser(), url);
+
+  TabContents* tab_contents = browser()->GetSelectedTabContents();
+  EXPECT_FALSE(tab_contents->is_crashed());
+}
+