chromium/third_party/blink/manual_tests/resources/navigation-during-onload-container.html

<script>
onload = function() {
  window.location.replace("#foo");
};
</script>
container
<iframe src="http://127.0.0.1:8000/history/resources/back-during-onload-middle.html"></iframe>
<p>
Click the back button and see if the browser crashes.
</p>