LayoutTests/fast/loader/javascript-url-iframe-remove-on-navigate.html

<iframe src="resources/empty-subframe.html" id="target"></iframe>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

let frame = document.getElementById("target");

window.addEventListener("load", function() {
    frame.contentWindow.onbeforeunload = function() {
        setTimeout(function() {
            frame.src = "javascript:alert('FAIL')";
        }, 0);
    };
    document.write("PASS - Javascript URL blocked without crashing.");
    if (window.testRunner)
        testRunner.notifyDone();
}, false);
</script>