1<html> 2<script> 3window.log = function(message) 4{ 5 document.getElementById("log").innerText += message + "\n"; 6} 7 8function childLoaded() 9{ 10 log("Child window loaded."); 11 window.childWindow.addAndTransferIframe(); 12} 13 14function start() 15{ 16 window.childWindow = window.open("iframe-reparenting-close-window-child.html", "_blank"); 17 window.childWindow.addEventListener("load", childLoaded, false); 18} 19 20</script> 21<body> 22<p>Bug: https://bugs.webkit.org/show_bug.cgi?id=70147</p> 23<p>This test recreates scenario when an iframe is reparented from one page to another using 'live iframe transfer' 24 (with adoptNode() used on the iframe right before re-parenting into the other page's DOM tree). 25 Then the original page is closed, destroying some internal objects that are associated with the top frame/page/WebVeiw.</p> 26<p>In Chromium, this destroys the underlying NotificationPresenter object which is associated with the Page, and as a result, the use of webkitNotification object from JavaScript can crash the browser or return bogus results ('use-after-delete'). 27 Open this test in Chromium and click the button to start the test. If the test doesn't crash, and prints expected results, the bug is not regressed.</p> 28<button onclick="start()">Start test</button> 29<pre id="log"></pre> 30</body> 31</html> 32