chromium/third_party/blink/web_tests/fast/loader/stateobjects/replacestate-in-onunload.html

<html>
<head>
<script>

if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

function log(txt)
{
    document.getElementById("logger").innerText += txt + "\n";
}


window.onload = function()
{
    if (!window.location.search) {
        window.onunload = function() { history.replaceState({}, '', '?FAIL') }
        window.location = window.location.href + "?PASS";
    } else {
        log(window.location.search.slice(1));
        if (window.testRunner)
            testRunner.notifyDone();
    }
}

</script>
<body>
<p>
This test calls replaceState during the onload handler to verify that the correct document's state is modified.
If the test succeeds the URL and text below will show a success message.
</p>
<pre id="logger"></pre>
</body>
</html>