chromium/third_party/blink/web_tests/fast/loader/stateobjects/pushstate-in-data-url-denied.html

<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}
</script>
<iframe src="javascript:
  try{
    history.pushState({}, '', 'data:');
    alert('FAIL data URL was manipulated via pushState.');
  } catch(e) {
    alert('PASS: data URLs cannot be manipulated via pushState.');
  }
  if (window.testRunner)
    testRunner.notifyDone();"></iframe>