diff --git a/components/script/dom/globalscope.rs b/components/script/dom/globalscope.rs
index ba207c3634c..f1537b25ebd 100644
--- a/components/script/dom/globalscope.rs
+++ b/components/script/dom/globalscope.rs
@@ -2428,14 +2428,18 @@ impl GlobalScope {
// Substep 3.1.3
while url.as_str() == "about:srcdoc" {
- document = document
- .browsing_context()
- .expect("iframe should have browsing context")
- .parent()
- .expect("iframes browsing_context should have parent")
- .document()
- .expect("iframes parent should have document");
-
+ // Return early if we cannot get a parent document. This might happen if
+ // this iframe was already removed from the parent page.
+ let Some(parent_document) =
+ document.browsing_context().and_then(|browsing_context| {
+ browsing_context
+ .parent()
+ .and_then(|parent| parent.document())
+ })
+ else {
+ return Referrer::NoReferrer;
+ };
+ document = parent_document;
url = document.url();
}
diff --git a/tests/wpt/meta/MANIFEST.json b/tests/wpt/meta/MANIFEST.json
index 01bb9e5685e..92c605ecdcd 100644
--- a/tests/wpt/meta/MANIFEST.json
+++ b/tests/wpt/meta/MANIFEST.json
@@ -6896,6 +6896,13 @@
null,
{}
]
+ ],
+ "srcdoc-removed-iframe-crash.html": [
+ "ebf4e1330a772ecffb5500d493c3225cae018d79",
+ [
+ null,
+ {}
+ ]
]
},
"the-img-element": {
diff --git a/tests/wpt/tests/html/semantics/embedded-content/the-iframe-element/srcdoc-removed-iframe-crash.html b/tests/wpt/tests/html/semantics/embedded-content/the-iframe-element/srcdoc-removed-iframe-crash.html
new file mode 100644
index 00000000000..ebf4e1330a7
--- /dev/null
+++ b/tests/wpt/tests/html/semantics/embedded-content/the-iframe-element/srcdoc-removed-iframe-crash.html
@@ -0,0 +1,12 @@
+
+
+
+ iframe with srcdoc content that loads after iframe is removed from the document
+
+
+
+
+
+