chromium/third_party/blink/web_tests/fast/dom/Window/post-message-detach-in-handler.html

<html>
<head>
<script src="../../../resources/js-test.js"></script>
</head>
<body>
<script>
description("Test that detaching document in window.postMessage() handler does not crash.");

window.jsTestIsAsync = true;

if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

function postMessageToSelf() {
    setInterval(function() { iframe.contentWindow.postMessage("msg", "*"); }, 0);
}

function receiveMessage(event) {
    testPassed("Received message " + event.data);
    document.body.removeChild(iframe);
    finishJSTest();
}

var iframe = document.createElement("iframe");
document.body.appendChild(iframe);
iframe.contentWindow.addEventListener("message", receiveMessage, false);
postMessageToSelf();
</script>
</body>
</html>