chromium/third_party/blink/web_tests/http/tests/security/frameNavigation/resources/top-navigate-in-onmessage.html

<body>
<script>
function navigate(e) {
  // double-nested setTimeout() to ensure that the UserGesturToken
  // isn't active when the navigation is triggered.
  setTimeout(function() {
    setTimeout(function() {
      top.location = "http://127.0.0.1:8000/navigation/resources/pass-and-notify-done.html";
    }, 0);
  }, 0);
}

window.addEventListener("message", navigate, false);
</script>
</body>