1 files changed, 57 insertions, 0 deletions
diff --git a/dom/browser-element/mochitest/file_browserElement_XFrameOptionsDeny.html b/dom/browser-element/mochitest/file_browserElement_XFrameOptionsDeny.html
new file mode 100644
index 000000000..338275aa3
--- /dev/null
+++ b/dom/browser-element/mochitest/file_browserElement_XFrameOptionsDeny.html
@@ -0,0 +1,57 @@
+<html>
+<body>
+
+<!-- Try to load in a frame a page which sends "X-Frame-Options: DENY", and a
+     cross-origin page which sends "X-Frame-Options: SAMEORIGIN". -->
+
+<script>
+
+// Make sure these iframes aren't too tall; they both need to fit inside the
+// iframe this page is contained in, without scrolling, in order for the test's
+// screenshots to work properly.
+
+var iframe1 = document.createElement('iframe');
+iframe1.height = '300px';
+var iframe2 = document.createElement('iframe');
+iframe2.height = '300px';
+document.body.appendChild(iframe1);
+document.body.appendChild(iframe2);
+
+// This causes our embedder to take a screenshot (and blocks until the
+// screenshot is completed).
+alert('step 1');
+
+// Wait for both iframes to load.
+
+var iframe1Loaded = false;
+iframe1.addEventListener('load', function iframe1Load() {
+  iframe1.removeEventListener('load', iframe1Load);
+  iframe1Loaded = true;
+  waitForBothLoads();
+});
+
+var iframe2Loaded = false;
+iframe2.addEventListener('load', function iframe2Load() {
+  iframe2.removeEventListener('load', iframe2Load);
+  iframe2Loaded = true;
+  waitForBothLoads();
+});
+
+function waitForBothLoads() {
+  if (iframe1Loaded && iframe2Loaded) {
+    setTimeout(function() {
+      // This causes our embedder to take another screenshot.
+      alert('step 2');
+    }, 0);
+  }
+}
+
+iframe1.src = 'file_browserElement_XFrameOptions.sjs?DENY';
+
+// Load iframe2 with the origin of our parent.  Since we have a different
+// origin and are inside <iframe mozbrowser>, this should not load.
+iframe2.src = 'http://mochi.test:8888/tests/dom/browser-element/mochitest/file_browserElement_XFrameOptions.sjs?SAMEORIGIN';
+</script>
+
+</body>
+</html>