LayoutTests/security/mutation-observer-frame-detach.html

   1 <script>
   2     function runTest() {
   3         var observer = new MutationObserver(()=>{p1.replaceWith(p2)});
   4         observer.observe(select,{childList:true});
   5         select[2] = option;
   6         document.head.appendChild(p2);
   7         var object = document.createElement("object");
   8         var frame = document.createElement("frame");
   9         audio.appendChild(option);
  10         p1.appendChild(object);
  11         object.data = "abc";
  12         document.all[9].appendChild(frame);
  13                 if (window.testRunner) {
  14                         testRunner.dumpAsText();
  15                         alert("test passed because nothing crashed");
  16                 }
  17     }
  18 </script>
  19 <body onload=runTest()>
  20     <p id="p1">
  21         <p id="p2">
  22             <audio id="audio">
  23                 <select id="select">
  24                     <option id="option"></option>
  25                 </select>
  26             </audio>
  27         </p>
  28     </p>
  29 </body>