http/tests/security/window-named-valueOf.html

<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
    testRunner.setCanOpenWindows();
    testRunner.setCloseRemainingWindowsWhenComplete(true);
}
</script>
<body>
This passes if it doesn't alert the contents of innocent-victim.
<script>
window.onload = function()
{
    frame = document.body.appendChild(document.createElement("iframe"));
    frame.src = "http://localhost:8080/security/resources/innocent-victim-with-iframe.html";
    frame.onload = function() {
        frame.onload = null;

        frame.contentWindow[0].location = "data:text/html,<script>(" + function() {
            try {
                window.name = "valueOf";
                obj = window.open();
                obj.__proto__.__proto__ = parent;
                alert(obj.valueOf.constructor("return document.body.innerHTML")());
            } catch(ex) {
            }
            if (window.testRunner)
                testRunner.notifyDone();
        } + ")()</scr" + "ipt>";
    }
}
</script>