1 <html> 2 <script> 3 window.log = function(message) 4 { 5 document.getElementById("log").innerText += message + "\n"; 6 } 7 8 function childLoaded() 9 { 10 log("Child window loaded."); 11 window.childWindow.addAndTransferIframe(); 12 } 13 14 function start() 15 { 16 window.childWindow = window.open("iframe-reparenting-close-window-child.html", "_blank"); 17 window.childWindow.addEventListener("load", childLoaded, false); 18 } 19 20 </script> 21 <body> 22 <p>Bug: https://bugs.webkit.org/show_bug.cgi?id=70147</p> 23 <p>This test recreates scenario when an iframe is reparented from one page to another using 'live iframe transfer' 24 (with adoptNode() used on the iframe right before re-parenting into the other page's DOM tree). 25 Then the original page is closed, destroying some internal objects that are associated with the top frame/page/WebVeiw.</p> 26 <p>In Chromium, this destroys the underlying NotificationPresenter object which is associated with the Page, and as a result, the use of webkitNotification object from JavaScript can crash the browser or return bogus results ('use-after-delete'). 27 Open this test in Chromium and click the button to start the test. If the test doesn't crash, and prints expected results, the bug is not regressed.</p> 28 <button onclick="start()">Start test</button> 29 <pre id="log"></pre> 30 </body> 31 </html> 32
