third_party/WebKit/LayoutTests/fast/parser/resources/set-parent-to-javascript-url.html

<script>
// Capture window.parent: once this context navigates, window.parent always returns null.
var p = parent;
alert(1);
parent.document.getElementsByTagName('iframe')[0].src = "javascript:alert(2),'PASS<script>alert(3)<\/script>'";
alert(4);
p.setTimeout("done()", 0);
</script>