chromium/src/third_party/blink/web_tests/fast/parser/append-child-followed-by-document-write.html

<script>
function go() {
  document.open();
  var a = document.createElement("a");
  document.appendChild(a);
  document.write("<b id='b'></b>");
  var b = document.getElementById('b');

  // Ideally we would use the dump-as-markup test framework for this test, but
  // the contortions we go through here are too tricky for dump-as-markup.
  // TODO(esprehn): Is this really true?
  alert("document.documentElement.outerHTML: " + document.documentElement.outerHTML + "\n" +
        "document.childNodes.length: " + document.childNodes.length + "\n" +
        "b element: " + b + "\n");
}

window.addEventListener("load", go, false);

if (window.testRunner)
    testRunner.dumpAsText();
</script>
This test covers some tricky ground where we call appendChild between
document.open an document.write.  This sequence of calls results in an unusual
situation where the parser is in the Initial state but the document is not
empty.