[Webkit-unassigned] [Bug 44965] DOM mutation crash in WebCore::Node::createRendererIfNeeded()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=44965


Tony Gentilcore <tonyg at chromium.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|tonyg at chromium.org          |webkit-unassigned at lists.web
                   |                            |kit.org
                 CC|                            |tonyg at chromium.org




--- Comment #2 from Tony Gentilcore <tonyg at chromium.org>  2010-09-15 16:11:54 PST ---
Here's a slightly simpler repro (the url() wasn't necessary):

<style>
use:nth-child(1) {
  content: "foo"
}
</style>

<svg>
  <use>
    <font-face font-family="family-name">
  </use>
</svg>

But this all takes place during style recalculation which I'm completely unfamiliar with. I'm releasing the bug.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.