[Webkit-unassigned] [Bug 9833] REGRESSION: Reproducible crash: RenderMenuList.cpp:58: failed assertion `!m_first' Abort trap in debug builds

[bugzilla-daemon at opendarwin.org]

http://bugzilla.opendarwin.org/show_bug.cgi?id=9833





------- Comment #3 from timothy at hatcher.name  2006-07-10 07:49 PDT -------
There is a way to crash this under Release.

0) Release build.
1) Go to the attached reduction.
2) Select "Click Me"
3) Then select the blank item.
4) Close the window and it will crash.

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x000000a8

Thread 0 Crashed:
0   com.apple.WebCore           0x01182882
WebCore::RenderContainer::destroyLeftoverChildren() + 22
(RenderContainer.cpp:64)
1   com.apple.WebCore           0x0118926c WebCore::RenderFlow::destroy() + 44
(RenderFlow.cpp:188)
2   com.apple.WebCore           0x01243765 WebCore::Node::detach() + 41
(Node.cpp:721)
3   com.apple.WebCore           0x010f6be1 WebCore::ContainerNode::detach() +
29 (Node.h:92)
4   com.apple.WebCore           0x010f6be1 WebCore::ContainerNode::detach() +
29 (Node.h:92)
5   com.apple.WebCore           0x010f6be1 WebCore::ContainerNode::detach() +
29 (Node.h:92)
6   com.apple.WebCore           0x010ed194 WebCore::Document::detach() + 216
(Document.cpp:987)
7   com.apple.WebCore           0x010d6422
WebCore::FrameMac::setView(WebCore::FrameView*) + 282 (FrameMac.mm:574)
8   com.apple.WebCore           0x010f9b50 -[WebCoreFrameBridge close] + 34
(WebCoreFrameBridge.mm:503)
9   com.apple.WebKit            0x00320eb8 -[WebFrameBridge close] + 49
(WebFrameBridge.m:658)
10  com.apple.WebKit            0x0032e05c -[WebFrame(WebPrivate)
_detachFromParent] + 359 (WebFrame.m:580)
11  com.apple.WebKit            0x00357214 -[WebView(WebPrivate) _close] + 135
(WebView.m:603)


-- 
Configure bugmail: http://bugzilla.opendarwin.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.