Index: LayoutTests/fast/frames/javascript-url-style-crash.html |
diff --git a/LayoutTests/fast/frames/javascript-url-style-crash.html b/LayoutTests/fast/frames/javascript-url-style-crash.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..15c967589744a99fee772dd842f4f08b703e6c54 |
--- /dev/null |
+++ b/LayoutTests/fast/frames/javascript-url-style-crash.html |
@@ -0,0 +1,21 @@ |
+<!DOCTYPE html> |
+<body> |
+<script> |
+function callback() { |
+ style0.innerHTML = ''; |
+ iframe0.removeChild(style0); |
+} |
+ |
+style0=document.createElement('style'); |
+style0.innerHTML = 'span { color: blue; }'; |
+ |
+iframe0=document.createElement('iframe'); |
+iframe0.appendChild(style0); |
+iframe0.src='javascript:window.top.callback();'; |
+document.body.appendChild(iframe0); |
+ |
+if (window.testRunner) |
+ testRunner.dumpAsText(); |
+</script> |
+<p>PASS unless crash</p> |
+</body> |