chromium/third_party/blink/web_tests/fast/dom/HTMLScriptElement/script-element-moved-by-onerror-sync-crash.html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../../../resources/js-test.js"></script>
<script>
var jsTestIsAsync = true;
var newScriptElement;

function start()
{
    newScriptElement = document.createElement('script');
    newScriptElement.async = false;
    document.body.appendChild(newScriptElement);
    newScriptElement.onerror = customOnError;
    newScriptElement.src = 'foobarbaz';
}

function customOnError()
{
    document.body.removeChild(newScriptElement);
    var otherDocument = document.getElementById('frame').contentWindow.document;
    otherDocument.documentElement.appendChild(newScriptElement);
    finishJSTest();
}
</script>
</head>
<body onload="start()">
Checks that we handle sync scripts which move to a different document inside their onerror handlers.
<div id="console"></div>
<iframe id="frame"></iframe>
</body>
</html>