Thanks @hmin ! I have tried it. For instrumentation test, the method doesn't work for the broadcast test case, but "iframe.contentDocument.write(XXX)" method works for multi-frame test case, so I can avoid to use extra source for sub-frame and can delete the fixme comment. By the way, the method works well when I put the extension to core shell Activity and access broadcast.html frome "file:///" protocol from device.