document.open(): remove fragment before propagating entry document's URL

This is another part of the effort to overhaul document.open() as outlined in #3818.

Tests: web-platform-tests/wpt#10817.

Fixes #2555.

Author: TimothyGu

source

@@ -90985,9 +90985,20 @@ document.body.appendChild(frame)</code></pre>
    <li><p><span data-x="concept-node-replace-all">Replace all</span> with null within
    <var>document</var>, without firing any mutation events.</p></li>
 
-   <li><p>If <var>document</var> is <span>fully active</span>, then run the <span>URL and history
-   update steps</span> with <var>document</var> and <var>entryDocument</var>'s <span
-   data-x="concept-document-url">URL</span>.</p></li>
+   <li>
+    <p>If <var>document</var> is <span>fully active</span>, then:</p>
+
+    <ol>
+     <li><p>Let <var>newURL</var> be a copy of <var>entryDocument</var>'s <span
+     data-x="concept-document-url">URL</span>.</p></li>
+
+     <li><p>If <var>entryDocument</var> is not <var>document</var>, then set <var>newURL</var>'s
+     <span data-x="concept-url-fragment">fragment</span> to null.</p></li>
+
+     <li><p>Run the <span>URL and history update steps</span> with <var>document</var> and
+     <var>newURL</var>.</p></li>
+    </ol>
+   </li>
 
    <!-- <span>the document's referrer</span> stays the same -->