third_party/WebKit/LayoutTests/http/tests/security/location-change-from-detached-DOMWindow.html

<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

window.onmessage = function(e) { 
    document.documentElement.appendChild(document.createTextNode(e.data));
    if (window.testRunner)
        testRunner.notifyDone();
}

var i = document.documentElement.appendChild(document.createElement('iframe'));
var f = frames[0].Function;
i.onload = function() {
  f("location.replace('javascript:window.top.postMessage(\\'FAIL\\', \\'*\\')')")();
  setTimeout(function() {
    window.postMessage("PASS", "*");
  }, 0);
}
i.src = 'https://localhost:8443/security/resources/innocent-victim.html';
</script>