chromium/third_party/blink/web_tests/fast/frames/detach-during-initial-load.html

<!DOCTYPE html>
<html>
<head>
<script src="../../resources/js-test.js"></script>
</head>
<body>
<script>
description("Detaching a frame while loading the initial blank page shouldn't cause a UaF.");
var observer = new MutationObserver(function()
    {
        var frame = document.querySelector('#test');
        if (frame) {
            frame.parentNode.removeChild(frame);
            observer.disconnect();
        }
    }
);
observer.observe(document.body, {childList: true});
</script>
<iframe id="test"></iframe>
</body>
</html>