OLD | NEW |
| (Empty) |
1 <html> | |
2 <head> | |
3 <script src="/js-test-resources/js-test.js"></script> | |
4 </head> | |
5 <body> | |
6 <script> | |
7 var jsTestIsAsync = true; | |
8 description('This is a regression test for crbug.com/400476. It should not crash
and then brag about it.') | |
9 | |
10 var root = document.documentElement; | |
11 var iframe = root.ownerDocument.createElement('iframe'); | |
12 var timeouts = []; | |
13 iframe.onload = iframeOnload; | |
14 root.appendChild(iframe); | |
15 | |
16 function iframeOnload() { | |
17 var defaultView = iframe.contentDocument.defaultView; | |
18 defaultView.onpageshow = onPageShow; | |
19 iframe.src = null; | |
20 timeouts[timeouts.length] = window.setTimeout(nextIframeLoaded, 100); | |
21 } | |
22 | |
23 function onPageShow() { | |
24 eventObj = arguments[0]; | |
25 } | |
26 | |
27 function nextIframeLoaded() { | |
28 timeouts.forEach(window.clearTimeout); | |
29 | |
30 // Access of eventObj.path caused the crash. | |
31 // The test is somewhat flaky, in that the test may pass as correct | |
32 // despite the bug being the code. The exact conditions | |
33 // are unclear, but 1, asan helps detect the crash and 2, the | |
34 // preceeding gc()s increase the likelihood of it occurring. | |
35 gc(); | |
36 gc(); | |
37 gc(); | |
38 gc(); | |
39 gc(); | |
40 var path = eventObj.path; | |
41 debug(path); | |
42 | |
43 testPassed('totally did not crash.'); | |
44 finishJSTest(); | |
45 } | |
46 </script> | |
47 </body> | |
48 </html> | |
OLD | NEW |