| OLD | NEW | 
 | (Empty) | 
|   1 <html> |  | 
|   2 <head> |  | 
|   3 <script src="/js-test-resources/js-test.js"></script> |  | 
|   4 </head> |  | 
|   5 <body> |  | 
|   6 <script> |  | 
|   7 var jsTestIsAsync = true; |  | 
|   8 description('This is a regression test for crbug.com/400476. It should not crash
     and then brag about it.') |  | 
|   9  |  | 
|  10 var root = document.documentElement; |  | 
|  11 var iframe = root.ownerDocument.createElement('iframe'); |  | 
|  12 iframe.onload = iframeOnload; |  | 
|  13 root.appendChild(iframe); |  | 
|  14  |  | 
|  15 function iframeOnload() { |  | 
|  16     var defaultView = iframe.contentDocument.defaultView; |  | 
|  17     defaultView.onpageshow = onPageShow; |  | 
|  18     iframe.src = null; |  | 
|  19     window.setTimeout(nextIframeLoaded, 100); |  | 
|  20 } |  | 
|  21  |  | 
|  22 function onPageShow() { |  | 
|  23     eventObj = arguments[0]; |  | 
|  24 } |  | 
|  25  |  | 
|  26 function nextIframeLoaded() { |  | 
|  27     // Access of eventObj.path caused the crash. |  | 
|  28     // The test is somewhat flaky, in that the test may pass as correct |  | 
|  29     // despite the bug being the code. The exact conditions |  | 
|  30     // are unclear, but 1, asan helps detect the crash and 2, the |  | 
|  31     // preceeding gc()s increase the likelihood of it occurring. |  | 
|  32     gc(); |  | 
|  33     gc(); |  | 
|  34     gc(); |  | 
|  35     gc(); |  | 
|  36     gc(); |  | 
|  37     var path = eventObj.path; |  | 
|  38     debug(path); |  | 
|  39  |  | 
|  40     testPassed('totally did not crash.'); |  | 
|  41     finishJSTest(); |  | 
|  42 } |  | 
|  43 </script> |  | 
|  44 </body> |  | 
|  45 </html> |  | 
| OLD | NEW |