chromium/third_party/blink/web_tests/fast/dom/dir-no-body.html

<html>
<head>
<script>
function print(message, color) 
{
    var paragraph = document.createElement("div");
    paragraph.appendChild(document.createTextNode(message));
    paragraph.style.fontFamily = "monospace";
    if (color)
        paragraph.style.color = color;
    document.getElementById("console").appendChild(paragraph);
}

function test() 
{
    if (window.testRunner)
        testRunner.dumpAsText();
        
    var doc = document.implementation.createHTMLDocument("");
    doc.body.parentNode.removeChild(doc.body);
    doc.dir = 1;
    
    print("PASS: you didn't crash.", "green");
}
</script>
</head>

<body onload="test();">
<p>This page test for a crash when setting the dir property of an HTML document with no body.</p>
<p>If the test passes, you'll see a 'PASS' message below.</p>
<hr>

<div id='console'></div>

</body>
</html>