javascript-url-as-framesrc-crash.html

<head>
<script language="JavaScript">
// See https://bugs.webkit.org/show_bug.cgi?id=26230

if (window.testRunner) {
    testRunner.dumpAsText();
}

function makeFrameContents() {
    var doc = theFrame.document;
    doc.open();
    doc.write('<img src=no-image-resource-required.png>');
    doc.close();
    return "SUCCESS (as long as we didn't crash, claim victory)";
}
</script>
</head>

<frameset>
    <frame name="theFrame" src="javascript:parent.makeFrameContents()">
</frameset>

chromium/third_party/blink/web_tests/fast/frames/javascript-url-as-framesrc-crash.html