chromium/third_party/blink/web_tests/images/image-document-write-assert.html

<!DOCTYPE html>
<html>
<script>

if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.setPopupBlockingEnabled(false);
    testRunner.waitUntilDone();
}

function log(message)
{
    var console = document.getElementById("console");
    console.appendChild(document.createTextNode(message + "\n"));
}

function loadPage()
{
    var newwindow = window.open("resources/dice.png");
    newwindow.onload = function() {
	    if (window.eventSender) {
		newwindow.document.write("This doesn't crash");
 		log ("Test Success");
		testRunner.notifyDone();
	   } else 
		newwindow.document.write("This doesn't crash");
    };
}
</script>
<body onload="loadPage()">
<p>This tests that writing on an "image page" doesn't asserts the tab. This test requires testRunner to run.  To test manually, open <a href="resources/dice.png">this image</a> in a browser window, and write into the page using document.write. It must not crash.</p>
<pre id="console"></pre>
</body>
</html>