| OLD | NEW |
| (Empty) |
| 1 <html> | |
| 2 <head> | |
| 3 <script src="/js-test-resources/js-test.js"></script> | |
| 4 </head> | |
| 5 <body> | |
| 6 <script> | |
| 7 var jsTestIsAsync = true; | |
| 8 description('This is a regression test for crbug.com/400476. It should not crash
and then brag about it.') | |
| 9 | |
| 10 var root = document.documentElement; | |
| 11 var iframe = root.ownerDocument.createElement('iframe'); | |
| 12 iframe.onload = iframeOnload; | |
| 13 root.appendChild(iframe); | |
| 14 | |
| 15 function iframeOnload() { | |
| 16 var defaultView = iframe.contentDocument.defaultView; | |
| 17 defaultView.onpageshow = onPageShow; | |
| 18 iframe.src = null; | |
| 19 window.setTimeout(nextIframeLoaded, 100); | |
| 20 } | |
| 21 | |
| 22 function onPageShow() { | |
| 23 eventObj = arguments[0]; | |
| 24 } | |
| 25 | |
| 26 function nextIframeLoaded() { | |
| 27 // Access of eventObj.path caused the crash. | |
| 28 // The test is somewhat flaky, in that the test may pass as correct | |
| 29 // despite the bug being the code. The exact conditions | |
| 30 // are unclear, but 1, asan helps detect the crash and 2, the | |
| 31 // preceeding gc()s increase the likelihood of it occurring. | |
| 32 gc(); | |
| 33 gc(); | |
| 34 gc(); | |
| 35 gc(); | |
| 36 gc(); | |
| 37 var path = eventObj.path; | |
| 38 debug(path); | |
| 39 | |
| 40 testPassed('totally did not crash.'); | |
| 41 finishJSTest(); | |
| 42 } | |
| 43 </script> | |
| 44 </body> | |
| 45 </html> | |
| OLD | NEW |