Index: LayoutTests/fast/loader/unload-mutation-crash.html |
diff --git a/LayoutTests/fast/loader/unload-mutation-crash.html b/LayoutTests/fast/loader/unload-mutation-crash.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..3a8f3232c5fa8455ecb53c4f95cddc43f3eac491 |
--- /dev/null |
+++ b/LayoutTests/fast/loader/unload-mutation-crash.html |
@@ -0,0 +1,23 @@ |
+<script> |
+if (window.testRunner) |
+ window.testRunner.dumpAsText(); |
+ |
+function start() { |
+ window.firstFrame = document.createElement('iframe'); |
+ document.body.appendChild(window.firstFrame); |
+ window.secondFrame = document.createElement('iframe'); |
+ window.secondFrame.src = 'javascript:window.top.maybeStart();'; |
+ window.firstFrame.contentDocument.documentElement.appendChild(window.secondFrame); |
+} |
+ |
+function maybeStart() { |
+ window.secondFrame.contentWindow.onunload = function() { |
+ document.documentElement.removeChild(window.bodyEl); |
+ }; |
+ |
+ window.firstFrame.src = 'javascript:"";'; |
+ console.log("PASS unless crash."); |
+} |
+</script> |
+<body id=bodyEl onload=start()></body> |
+</html> |