crash-replacing-location-before-load.html

<script>
if (parent == window) {
  if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
  }
  function replaceHash(frag) {
    frames[0].location.replace('#' + frag);
  }
  onload = function() {
    var f = document.createElement("iframe");
    f.src = location;
    f.onload = function() {
      delete f.onload;
      replaceHash('bar');
      if (window.testRunner)
        testRunner.notifyDone();
    }
    document.body.appendChild(f);
    replaceHash('foo');
  }
}
</script>
<!-- If we do not crash, then this test was successful. -->
<body>PASS</body>

chromium/third_party/blink/web_tests/fast/loader/crash-replacing-location-before-load.html