<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>Resource Timing - CORS requests</title>
<link rel="help" href="https://w3c.github.io/resource-timing/#cross-origin-resources">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
</head>
<body>
<script>
function with_iframe(url) {
    return new Promise(function(resolve) {
        var frame = document.createElement('iframe');
        frame.className = 'test-iframe';
        frame.src = url;
        frame.onload = function() { resolve(frame); };
        document.body.appendChild(frame);
    });
}

promise_test(async t => {
    let observer;
    const promise = new Promise(resolve => {
        observer = new PerformanceObserver(resolve);
    });
    observer.observe({entryTypes: ['resource']});

    const frame = await with_iframe("http://127.0.0.1:8800/WebKit/resource-timing/resources/server-timing.py");

    const result = await promise;
    const entries = result.getEntries();

    frame.remove();

    assert_true(entries.length > 0);
    for (let entry of entries)
        assert_equals(entry.serverTiming.length, 0);
}, "Make sure cross origin server timing is not exposed on iframes");
</script>
</body>
</html>
