OLD | NEW |
| (Empty) |
1 <html> | |
2 <head> | |
3 <script src="/js-test-resources/js-test.js"></script> | |
4 </head> | |
5 <body> | |
6 <script> | |
7 var jsTestIsAsync = true; | |
8 description('This is a regression test for crbug.com/400476. It should not crash
and then brag about it.') | |
9 | |
10 var root = document.documentElement; | |
11 var iframe = root.ownerDocument.createElement('iframe'); | |
12 iframe.onload = iframeOnload; | |
13 root.appendChild(iframe); | |
14 | |
15 function iframeOnload() { | |
16 var defaultView = iframe.contentDocument.defaultView; | |
17 defaultView.onpageshow = onPageShow; | |
18 iframe.src = null; | |
19 window.setTimeout(nextIframeLoaded, 100); | |
20 } | |
21 | |
22 function onPageShow() { | |
23 eventObj = arguments[0]; | |
24 } | |
25 | |
26 function nextIframeLoaded() { | |
27 // Access of eventObj.path caused the crash. | |
28 // The test is somewhat flaky, in that the test may pass as correct | |
29 // despite the bug being the code. The exact conditions | |
30 // are unclear, but 1, asan helps detect the crash and 2, the | |
31 // preceeding gc()s increase the likelihood of it occurring. | |
32 gc(); | |
33 gc(); | |
34 gc(); | |
35 gc(); | |
36 gc(); | |
37 var path = eventObj.path; | |
38 debug(path); | |
39 | |
40 testPassed('totally did not crash.'); | |
41 finishJSTest(); | |
42 } | |
43 </script> | |
44 </body> | |
45 </html> | |
OLD | NEW |