implicit-head-in-fragment-crash.html

<SCRIPT>
  if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
  }
  setTimeout(function () {
    node = document.createElement("M");
    document.open();
    node.innerHTML = "<body>";
    node.innerHTML = "<p>";

    node = document.createDocumentFragment();
    document.open();
    node.innerHTML = "<body>";
    node.innerHTML = "<p>";

    var b = document.body;
    document.write("<a href='https://bugs.webkit.org/show_bug.cgi?id=25694'>bug 25694</a><br>");
    document.write(b ? "FAIL: document.body is not null (but at least we didn't crash)" : "PASS");
    document.close();
    if (window.testRunner)
      testRunner.notifyDone();
  }, 0);
</SCRIPT>

chromium/third_party/blink/web_tests/fast/parser/implicit-head-in-fragment-crash.html