Experiment with restricting form submission with open elements.

third_party/WebKit/LayoutTests/http/tests/security/dangling-markup/resources/helper.js

Index: third_party/WebKit/LayoutTests/http/tests/security/dangling-markup/resources/helper.js
diff --git a/third_party/WebKit/LayoutTests/http/tests/security/dangling-markup/resources/helper.js b/third_party/WebKit/LayoutTests/http/tests/security/dangling-markup/resources/helper.js
new file mode 100644
index 0000000000000000000000000000000000000000..7d5ad6d10d025e836701eeb96754bad2e17076ed
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/security/dangling-markup/resources/helper.js
@@ -0,0 +1,37 @@
+function assert_no_message_from_frame(test, frame) {
+  window.addEventListener("message", test.step_func(e => {
+    assert_not_equals(e.source, frame.contentWindow);
+  }));
+}
+
+function appendAndSubmit(test, frame) {
+  return new Promise((resolve, reject) => {
+    frame.onload = test.step_func(_ => {
+      frame.onload = null;
+      frame.contentDocument.querySelector('form').addEventListener("error", _ => {
+        resolve("error");
+      });
+      frame.contentDocument.querySelector('form').addEventListener("submit", _ => {
+        resolve("submit");
+      });
+      frame.contentDocument.querySelector('[type=submit]').click();
+    });
+    document.body.appendChild(frame);
+  });
+}
+
+function assert_no_submission(test, frame) {
+  assert_no_message_from_frame(test, frame);
+
+  appendAndSubmit(test, frame)
+    .then(test.step_func_done(result => {
+      assert_equals(result, "error");
+      frame.remove();
+    }));
+}
+
+function createFrame(markup) {
+  var i = document.createElement('iframe');
+  i.srcdoc = `${markup}sekrit`;
+  return i;
+}