[Webkit-unassigned] [Bug 45713] Regression: crash in nightlies and Chrome 7.0.517 on object.removeAttribute("type")

Fri Sep 17 10:15:42 PDT 2010

https://bugs.webkit.org/show_bug.cgi?id=45713

Aryeh Gregor <Simetrical+webkit at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Regression: crash in        |Regression: crash in
                   |nightlies and Chrome        |nightlies and Chrome
                   |7.0.517 when viewing        |7.0.517 on
                   |particular page             |object.removeAttribute("typ
                   |                            |e")

--- Comment #1 from Aryeh Gregor <Simetrical+webkit at gmail.com>  2010-09-17 10:15:42 PST ---
Minimal test case:

data:text/html,<!doctype html>
<script>
var el = document.createElement("object");
el.type = "";
el.removeAttribute("type");
</script>

This causes a sad tab for me in Chrome dev, and a crash in the latest WebKit nightly (r67637).

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.