chromium/third_party/blink/web_tests/fast/events/javascript-uri-navigation-blocked-in-unload-handler.html

<html>
<head>
<title>Ensure that javascript: document navigations are blocked during onunload.</title>
</head>
<body>
<pre id="console"></pre>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

function log(msg) {
    document.getElementById("console").appendChild(document.createTextNode(msg + "\n"));
}

var i = document.body.appendChild(document.createElement('iframe'));
i.contentWindow.onunload = function() {
    // This navigation should be compliant with step 4 of
    // https://html.spec.whatwg.org/#navigate.
    // "If there is a preexisting attempt to navigate browsingContext, and the
    // source browsing context is the same as browsingContext, and that attempt is
    // currently running the unload a document algorithm, then return without
    // affecting the preexisting attempt to navigate browsingContext."
    i.src = "javascript:'<script>top.log(\\'FAIL: document navigation not aborted\\');<" +
            "/script>'";
}

i.onload = function() {
  if (window.testRunner)
      testRunner.notifyDone();
}

i.src = "data:text/html,test";
</script>
</body>
</html>