chromium/third_party/blink/web_tests/html/embedded_content/iframe-load-before-load-crash.html

<!DOCTYPE html>
<body>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script>
var iframe1;
var t = async_test('Do not crash if an IFRAME element is loaded twice.');
window.onload = t.step_func_done(() => {
  var fragment = document.createDocumentFragment();
  var script = fragment.appendChild(document.createElement('script'));
  iframe1 = fragment.appendChild(document.createElement('iframe'));
  fragment.appendChild(document.createTextNode('foo'));
  script.textContent = 'document.body.appendChild(iframe1);';
  document.body.appendChild(fragment);
});
</script>
</body>