unload-mutation-crash.html | Explore in Territory

<script>
if (window.testRunner)
    testRunner.dumpAsText();

function start() {
  window.firstFrame = document.createElement('iframe');
  document.body.appendChild(window.firstFrame);
  window.secondFrame = document.createElement('iframe');
  window.secondFrame.src = 'javascript:window.top.maybeStart();';
  window.firstFrame.contentDocument.documentElement.appendChild(window.secondFrame);
}

function maybeStart() {
  window.secondFrame.contentWindow.onunload = function() {
    document.documentElement.removeChild(window.bodyEl);
  };

  window.firstFrame.src = 'javascript:"";';
  console.log("PASS unless crash.");
}
</script>
<body id=bodyEl onload=start()></body>
</html>

chromium/third_party/blink/web_tests/fast/loader/unload-mutation-crash.html