chromium/third_party/blink/web_tests/http/tests/security/contentSecurityPolicy/img-blocked-no-gc-crash.html

<!DOCTYPE html>
<html>
<head>
<script src="/js-test-resources/testharness.js"></script>
<script src="/js-test-resources/testharnessreport.js"></script>
<meta http-equiv="Content-Security-Policy" content="img-src 'none'; script-src 'unsafe-inline'">
<script>
    const testCase = async_test(
        'Blocking an image via CSP doesn\'t crash if GC executes before the error event fires');

    function test() {
        (function () {
            var img = document.createElement('img');
            img.onload = testCase.step_func_done(() => assert_unreached());
            img.onerror = testCase.step_func_done(() => {});
            img.src = "../resources/abe.png";
        })();
        gc();
    }
</script>
</head>
<body onload='test();'>
    <p>
        This test ensures that blocking an image via CSP doesn't crash if GC
        executes before the error event fires.
    </p>
</body>
</html>