[V8] document.all gets confused about its prototype chain
[WebKit.git] / LayoutTests / http / tests / security / document-all.html
1 <script>
2 if (window.layoutTestController) {
3     layoutTestController.dumpAsText();
4     layoutTestController.waitUntilDone();
5 }
6
7 window.onload = function()
8 {
9     frame = document.body.appendChild(document.createElement("iframe"));
10     frame.src = "http://localhost:8080/security/resources/innocent-victim-with-iframe.html";
11     frame.onload = function() {
12         frame.onload = null;
13
14         frame.contentWindow[0].location = "data:text/html,<script>(" + function() {
15
16             setTimeout(function() {
17                 if (window.layoutTestController)
18                     layoutTestController.notifyDone();
19             }, 0);
20
21             window.name = "alert";
22             obj = document.all;
23             obj.__proto__ = parent;
24             alert(obj.alert.constructor("return document.body.innerHTML")());
25         } + ")()</scr" + "ipt>";
26     }
27 }
28 </script>