Caught this with DOM Fuzzer. I have a reduction that crashes in a slightly different manner, but in both cases, it's a null dereference due to null m_window->document().
Created attachment 47048 [details]
Committed revision 53555.
> Removed null check for document element - every document has one.
Untrue, see bug 31353.
I guess I meant bug 43677.
*** Bug 31353 has been marked as a duplicate of this bug. ***