chromium/third_party/blink/web_tests/images/destroyed-image-load-event.html

<body onload="test()">
<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=34490">bug 34490<a/>:
WebCore::ImageEventSender::dispatchPendingEvents() crashes in certain conditions.</p>
<div id="testRun"></div>
<div id="container"></div>
<script src="../resources/gc.js"></script>
<script>
if (window.testRunner) {
    testRunner.waitUntilDone();
    testRunner.dumpAsText();
}

var container = document.getElementById("container");
var testRunDiv = document.getElementById("testRun");
var remainingTestRuns = 30;

function test()
{
    testRunDiv.innerHTML = remainingTestRuns;

    if (--remainingTestRuns < 0) {
        testRunDiv.innerHTML = "PASS";
        if (window.testRunner)
            testRunner.notifyDone();
        return;
    }

    container.innerHTML = '<img src="resources/boston.gif" onload="loaded1()">' +
        '<img src="resources/boston.gif" onload="loaded2()">';
}

function loaded1()
{
    var img2 = document.getElementsByTagName("img")[1];
    img2.src = "";
    container.removeChild(img2);
    img2 = null;
    gc();
    setTimeout(test, 0);
}

function loaded2()
{
}
</script>
</body>