chromium/src/third_party/blink/web_tests/fast/parser/resources/document-open-in-unload-inner.html

This test passes if it doesn't crash.
<iframe srcdoc="Hi"></iframe>
<script>
frames[0].onunload = function () {
    document.open();
    document.write("PASS");
    document.close();
    parent.postMessage("Done", "*");
};
</script>