This page tests that you can correctly remove an object element with an invalid data URL in its beforeload listener without causing a crash.

FAIL FAIL