third_party/WebKit/LayoutTests/fast/loader/stateobjects/pushstate-in-data-url-denied.html

<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}
</script>
<iframe src="data:text/html,
  <script>
  try{
    history.pushState({}, '', 'data:');
    alert('FAIL data URL was manipulated via pushState.');
  } catch(e) {
    alert('PASS: data URLs cannot be manipulated via pushState.');
  }
  if (window.testRunner)
    testRunner.notifyDone();
  </script>"></iframe>