chromium/third_party/blink/web_tests/fast/dom/script-element-gc.html

<html>
<script>
function runTest() {
    if (window.testRunner) {
        testRunner.dumpAsText();
        testRunner.waitUntilDone();
    }

    var s = document.createElement('script');
    s.setAttribute('onload', 'alert("Script onload handler called!"); if (window.testRunner) testRunner.notifyDone()');
    s.id = "theScript";
    s.src = "resources/script-element-gc.js";
    
    document.body.appendChild(s);
}
</script>
<body onload="runTest()">
    This tests that removing the script element from the script loaded by the element itself, and then garbage collecting does not cause a crash when dispatching the onload element (because the script element was freed).
    <p>SUCCESS! Didn't Crash!</p>
</body>
</html>