chromium/third_party/blink/web_tests/http/tests/xmlhttprequest/resources/detached-frame.html

<head>
<script>
function test() {
    var xhr = new XMLHttpRequest;
    xhr.open("GET", "detached-frame.html");
    xhr.send();
    window.parent.childDocument = document; // GC protect
    xhr.onreadystatechange = function() {
        if (xhr.readyState == xhr.DONE) {
            var parentWindow = window.parent;
            parentWindow.document.body.removeChild(parentWindow.document.getElementsByTagName("iframe")[0]);
            parentWindow.document.body.innerHTML += "<p>PASS: No crash.</p>";
            if (parentWindow.testRunner)
                parentWindow.testRunner.notifyDone();
        }
    }
}
</script>
</head>
<body onload="test()">
</body>