Chromium Code Reviews Chromium Code Reviews
Issue 1675473002:
Update V8 security token correctly when installing a new Document. (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@master| Index: third_party/WebKit/LayoutTests/http/tests/security/opened-document-security-origin-resets-on-navigation.html |
| diff --git a/third_party/WebKit/LayoutTests/http/tests/security/opened-document-security-origin-resets-on-navigation.html b/third_party/WebKit/LayoutTests/http/tests/security/opened-document-security-origin-resets-on-navigation.html |
| new file mode 100644 |
| index 0000000000000000000000000000000000000000..c03e0adbbea5c1719d887496b9691bacec4b378e |
| --- /dev/null |
| +++ b/third_party/WebKit/LayoutTests/http/tests/security/opened-document-security-origin-resets-on-navigation.html |
| @@ -0,0 +1,25 @@ |
| +<!DOCTYPE html> |
| +<html> |
| +<head> |
| +<script src="/js-test-resources/js-test.js"></script> |
| +<script> |
| +var jsTestIsAsync = true; |
| +function runTest() { |
| + var frame = document.body.appendChild(document.createElement("iframe")); |
| + frame.src = "http://localhost:8000/security/resources/opened-document-security-origin-resets-on-navigation-frame.html"; |
| + frame.onload = function () { |
|
dcheng
2016/02/05 00:48:08
After this loads, frame tree looks like this:
[ M
|
| + frame.onload = null; |
| + var blob = new Blob(["<script>(" + function () { |
|
dcheng
2016/02/05 00:48:08
The blob URL has origin 127.0.0.1:8000. Once subfr
|
| + frame = document.documentElement.appendChild(document.createElement("iframe")); |
|
dcheng
2016/02/05 00:48:08
After subframe C loads, frame tree looks like this
|
| + frame.contentWindow.setTimeout("parent.document.open()", 0); |
|
dcheng
2016/02/05 00:48:08
document.open() apparently aliases the parent wind
|
| + setTimeout(function () { |
|
dcheng
2016/02/05 00:48:08
This setTimeout is set on the context of Subframe
|
| + location = "javascript:'<script>setTimeout(top.finishJSTest, 0); parent.eval(\"alert(location)\"); top.testFailed(\"context security origin was not updated!\");</scr" + "ipt>'" }, 0); |
| + } + "())</sc" + "ript>"], {type: "text/html"}); |
| + frame.contentWindow[0].location = URL.createObjectURL(blob); |
| + } |
| +} |
| +</script> |
| +</head> |
| +<body onload="runTest()"> |
| +</body> |
| +</html> |
