Same-document navigation in onload triggered by back navigation.
You should not crash.
We cannot use history.back() to test this, because it calls Page::goToItem (which calls FrameLoader::stopAllLoaders) first. Chromium's back button does not call stopAllLoaders first.