Crash when calling getCueAsHTML() on a TextTrackCue with empty text

Source/core/html/track/WebVTTParser.cpp

 /*
  * Copyright (C) 2011 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 310 matching lines @@
         return BadCue;
     return Id;
 }
 
 PassRefPtr<DocumentFragment>  WebVTTParser::createDocumentFragmentFromCueText(const String& text)
 {
     // Cue text processing based on
     // 4.8.10.13.4 WebVTT cue text parsing rules and
     // 4.8.10.13.5 WebVTT cue text DOM construction rules.
 
-    if (!text.length())
-        return 0;
-
     ASSERT(m_scriptExecutionContext->isDocument());
     Document* document = toDocument(m_scriptExecutionContext);
 
     RefPtr<DocumentFragment> fragment = DocumentFragment::create(document);
+
+    if (!text.length()) {
+        fragment->parserAppendChild(Text::create(document, ""));
+        return fragment;
+    }
+
     m_currentNode = fragment;
     m_tokenizer->reset();
     m_token.clear();
 
     m_languageStack.clear();
     SegmentedString content(text);
     while (m_tokenizer->nextToken(content, m_token))
         constructTreeFromToken(document);
 
     return fragment.release();
@@ skipping 214 matching lines @@
     unsigned oldPosition = *position;
     while (*position < length && data[*position] != '\r' && data[*position] != '\n')
         (*position)++;
     String line = String::fromUTF8(data + oldPosition, *position - oldPosition);
     skipLineTerminator(data, length, position);
     return line;
 }
 
 }