[Webkit-unassigned] [Bug 66241] Crash when inserting text with a trailing newline into a textarea via JS

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=66241





--- Comment #6 from Ryosuke Niwa <rniwa at webkit.org>  2011-08-24 19:25:50 PST ---
(In reply to comment #5)
> Why is the textNode detached by m_frame->document()->updateLayout()?

It's causing the shadow DOM tree to be re-created.  The text node is in the shadow tree.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.