chromium/third_party/blink/web_tests/fast/frames/detach-frame-nested-on-commit-no-crash.html

<!DOCTYPE html>
<html>
<head>
<script src="../../resources/js-test.js"></script>
<script>
description("Indirectly detaching frames on load completion should not crash.");

window.jsTestIsAsync = true;

function maybeStart()
{
    setTimeout(function() {
        window.secondFrame.contentWindow.onunload = function() {
            document.documentElement.removeChild(window.bodyEl);
            setTimeout(finishJSTest, 10);
        };
        window.firstFrame.src = 'about:blank';
    }, 0);
}
function runTest()
{
    window.firstFrame = document.createElement('iframe');
    document.body.appendChild(window.firstFrame);
    window.secondFrame = document.createElement('iframe');
    window.secondFrame.src = 'javascript:window.top.maybeStart();';
    window.firstFrame.contentDocument.documentElement.appendChild(window.secondFrame);
}

window.onload = runTest;
</script>
</head>
<body id=bodyEl>
</html>