chromium/third_party/blink/web_tests/fast/frames/resources/cached-page-2.html

<script>
function goBack() {
    window.opener.log("Back on page-2, timer is still firing.");
    history.back();
}

function loadNext() {
    if (window.opener.canExit3) {
        goBack();
        return;
    }

    window.opener.canExit2 = true;

    // The crash only happens when we scroll here!
    window.scrollBy(0, 100);

    window.opener.log("page-2, about to navigate to page-3.")
    // Location changes need to happen outside the onload handler to generate history entries.
    setTimeout(function() {location.href = "cached-page-3.html";}, 0);
}
</script>
<body onpageshow="loadNext()">
<div style="height: 1200px; background-color: green"></div>
</body>