image-loading-lazy-subframe-detached-crash.html (959B)
1 <!doctype html> 2 <html class="test-wait"> 3 <title>Crash when detaching a frame during a lazy-load operation</title> 4 <link rel="author" href="mailto:emilio@crisal.io" title="Emilio Cobos Álvarez"> 5 <link rel="author" href="https://mozilla.org" title="Mozilla"> 6 <link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1619858"> 7 <iframe srcdoc=""></iframe> 8 <script> 9 onload = function() { 10 let frame = document.querySelector("iframe"); 11 frame.contentDocument.body.innerHTML = ` 12 <div style="height: 300vh"></div> 13 <img loading="lazy" src="/images/blue96x96.png" width=96 height=96> 14 `; 15 let img = frame.contentDocument.querySelector("img"); 16 new IntersectionObserver(() => { 17 frame.remove(); 18 requestAnimationFrame(function() { 19 requestAnimationFrame(function() { 20 document.documentElement.className = ""; 21 }); 22 }); 23 }).observe(img); 24 frame.contentWindow.scrollTo(0, img.getBoundingClientRect().top); 25 }; 26 </script>