third_party/WebKit/LayoutTests/http/tests/navigation/pushstate-whitelisted-at-blob-denied.html

<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
    testRunner.addOriginAccessWhitelistEntry(location.origin, location.protocol, '', false);
}

var blobUrl = URL.createObjectURL(new Blob([
    "<script>" +
    "try {" +
    "    history.pushState(null, null, " + JSON.stringify(document.URL) + ");" +
    "    document.write('FAIL: pushState from blob:-URL succeeded.');" +
    "} catch(e) {" +
    "    document.write('PASS: pushState from blob:-URL was blocked.');" +
    "}" +
    "if (window.testRunner)" +
    "    testRunner.notifyDone();" +
    "<\/script>"
], {type:"text/html"}));

location.href = blobUrl;
</script>