chromium/third_party/blink/web_tests/fast/forms/resources/state-restore-broken-state-1.html

<body onload="handleLoad()">
<form action="state-restore-broken-state-2.html" name=f>
  <input name="name1" value="unmodified">
</form>

<script>
function handleLoad() {
    if (!parent.hasReloaded) {
        parent.hasReloaded = true;
        document.f.name1.value = 'modified';
        setTimeout("location.reload();", 0);

        window.onunload = function() {
            var stateArray = internals.formControlStateOfHistoryItem();
            // Omit the signature string because it is volatile.
            console.log('Generated state: [' + stateArray.slice(1) + ']');
        }

    } else if (!parent.isGoingBack) {
        var stateArray = internals.formControlStateOfHistoryItem();

        setTimeout(function() {
            window.location.href = 'go-back.html';
        }, 0);

        window.onunload = function() {
            stateArray.push('***broken***');
            internals.setFormControlStateOfHistoryItem(stateArray);
            parent.didLoadAnotherDocument();
        };
    } else {
        parent.didSecondLoad();
    }
}
</script>
</body>