state-api-on-detached-frame-crash.html

<html>
<script>

if (window.testRunner)
    testRunner.dumpAsText();

function runTest()
{
    var ifr = frames[0];
    document.body.removeChild(document.getElementsByTagName("iframe")[0])
    try {
        ifr.history.replaceState("foo", "bar");
    } catch (e) {
      // Ignore, expected
    }
    try {
        ifr.history.pushState("fu", "barred");
    } catch (e) {
      // Ignore, expected    
    }
    document.getElementById("log").textContent = "PASSED";
}

</script>
<body onload="runTest();">
Tests that calling <code>pushState</code> or <code>replaceState</code> on a detached frame doesn't crash.
<iframe src="about:blank">
</iframe>
<pre id="log"></pre>
</body>
</html>

chromium/third_party/blink/web_tests/fast/loader/stateobjects/state-api-on-detached-frame-crash.html