[Webkit-unassigned] [Bug 39143] REGRESSION (r59385) crash destroying inline renderers

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=39143





--- Comment #3 from James Robinson <jamesr at chromium.org>  2010-05-17 19:09:50 PST ---
Created an attachment (id=56307)
 --> (https://bugs.webkit.org/attachment.cgi?id=56307)
reduction

This is a reduction from the http://www.766900.com/ page.  It's probably not completely minimal but should be useful as a starting point.  The document.write() loop is a bit unfortunate, but it seems necessary to force the </font> tag to get parsed on a separate callstack from the rest of the page.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.