[Webkit-unassigned] [Bug 40828] New: http://www.mav-start.hu/english/index.php make browsers crash

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=40828

           Summary: http://www.mav-start.hu/english/index.php make
                    browsers crash
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: All
            Status: NEW
          Severity: Critical
          Priority: P1
         Component: WebCore JavaScript
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: ossy at webkit.org


http://www.mav-start.hu/english/index.php is 
the online hungarian railway guide.

If you choose an option from "Reduction" drop-down list, 
the browser will crash with this message:
ASSERTION FAILED: !object || object->isMenuList()
(../../../WebCore/rendering/RenderMenuList.h:139 WebCore::RenderMenuList* WebCore::toRenderMenuList(WebCore::RenderObject*))
Segmentation fault

I reproduced this bug with more WebKit based browser:
latest Chrome, Safari, QtTestBrowser, ...
(This page works correctly with IE8, FF3.5.9, Opera10)

The bug should be complex, it is related with <optgroup> 
and JS which manipulates its visibility.

simOptGroup can be found here: http://elvira.mav-start.hu/xslms/res/js/elvira.js

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.