diff --git a/navigation-api/navigate-event/replaceState-in-unload-then-remove-iframe.html b/navigation-api/navigate-event/replaceState-in-unload-then-remove-iframe.html
new file mode 100644
index 00000000000000..e97b72b1571732
--- /dev/null
+++ b/navigation-api/navigate-event/replaceState-in-unload-then-remove-iframe.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<iframe id="i" src="/common/blank.html"></iframe>
+<script>
+async_test(t => {
+  window.onload = t.step_func(() => {
+    i.contentWindow.onunload = t.step_func(() => {
+      i.contentWindow.history.replaceState(null, "", "#");
+      i.remove();
+      t.step_timeout(t.step_func_done(), 0);
+    });
+    i.contentWindow.location = "/common/blank.html?1";
+  });
+}, "reacting to the navigate event doesn't crash when replaceState is called in onunload");
+</script>
