chromium/third_party/blink/web_tests/fast/frames/reattach-in-unload.html

<!DOCTYPE html>
<body>
<script src="../../resources/js-test.js"></script>
<script>
description('Ensure that removing an iframe from the tree results in frame destruction');

var frame = document.createElement('iframe');
function handler() {
    var p = frame.parentNode;
    p.removeChild(frame);
    p.appendChild(frame);
}

document.body.appendChild(frame);
frame.contentWindow.onunload = handler;
frame.parentNode.removeChild(frame)
shouldBeNull("frame.contentWindow");

var div = document.body.appendChild(document.createElement('div'));
div.appendChild(frame);
div.removeChild(frame);
shouldBeNull("frame.contentWindow");
debug('Did not crash');
</script>
</body>