third_party/WebKit/LayoutTests/fast/parser/implicit-head-in-fragment-crash.html

   1 <SCRIPT>
   2   if (window.testRunner) {
   3     testRunner.dumpAsText();
   4     testRunner.waitUntilDone();
   5   }
   6   setTimeout(function () {
   7     node = document.createElement("M");
   8     document.open();
   9     node.innerHTML = "<body>";
  10     node.innerHTML = "<p>";
  11
  12     node = document.createDocumentFragment();
  13     document.open();
  14     node.innerHTML = "<body>";
  15     node.innerHTML = "<p>";
  16
  17     var b = document.body;
  18     document.write("<a href='https://bugs.webkit.org/show_bug.cgi?id=25694'>bug 25694</a><br>");
  19     document.write(b ? "FAIL: document.body is not null (but at least we didn't crash)" : "PASS");
  20     document.close();
  21     if (window.testRunner)
  22       testRunner.notifyDone();
  23   }, 0);
  24 </SCRIPT>