[Webkit-unassigned] [Bug 9833] New: Reproducible crash: RenderMenuList.cpp:58: failed assertion `!m_first' Abort trap in debug builds

[bugzilla-daemon at opendarwin.org]

http://bugzilla.opendarwin.org/show_bug.cgi?id=9833

           Summary: Reproducible crash: RenderMenuList.cpp:58: failed
                    assertion `!m_first' Abort trap in debug builds
           Product: WebKit
           Version: 420+ (nightly)
          Platform: Macintosh
        OS/Version: Mac OS X 10.4
            Status: NEW
          Keywords: NativePopUp
          Severity: normal
          Priority: P1
         Component: Forms
        AssignedTo: webkit-unassigned at opendarwin.org
        ReportedBy: ddkilzer at kilzer.net
                CC: adele at apple.com, darin at apple.com


In a debug build of WebKit r15300 (plus Patch v4 from Bug 9179) on Safari 2.0.4
(419.3) on Mac OS X 10.4.7 (8J135/PowerPC), I get a reproducible assertion
failure when changing the "Review" popup to "?" on the "Create attachment" web
page:

/Users/ddkilzer/Projects/Cocoa/WebKit/WebCore/rendering/RenderMenuList.cpp:58:
failed assertion `!m_first'
Abort trap

Steps to reproduce:

1. Start debug build of WebKit+Safari with NativePopUps.
2. Access a "Create attachment" link:
http://bugzilla.opendarwin.org/attachment.cgi?bugid=9833&action=enter
3. On the "Flags review" popup, change the value to "?".

Expected results:

Flags review popup changes to "?".

Actual results:

Assertion failure an crash (not even a crash log generated).


-- 
Configure bugmail: http://bugzilla.opendarwin.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.