[Webkit-unassigned] [Bug 56773] New: REGRESSION(81035): crash in RenderDetails::removeChild

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=56773

           Summary: REGRESSION(81035): crash in RenderDetails::removeChild
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
               URL: http://runescape.wikia.com/wiki/Special:Search
        OS/Version: Mac OS X 10.5
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: jamesr at chromium.org
                CC: hyatt at apple.com, mitz at webkit.org,
                    simon.fraser at apple.com, luiz at webkit.org


The URL above crashes after r81035.  stack:

#0  0x00000000016e2e3f in WebCore::RenderDetails::removeChild (this=0x7fffc0b2c6d8, oldChild=0x7fffc1306018)
    at third_party/WebKit/Source/WebCore/rendering/RenderDetails.cpp:94
#1  0x0000000000c032db in WebCore::RenderObject::remove (this=0x7fffc1306018) at third_party/WebKit/Source/WebCore/rendering/RenderObject.h:752
#2  0x000000000164cef2 in WebCore::RenderObject::destroy (this=0x7fffc1306018) at third_party/WebKit/Source/WebCore/rendering/RenderObject.cpp:2187
#3  0x00000000015e31a9 in WebCore::RenderBoxModelObject::destroy (this=0x7fffc1306018)
    at third_party/WebKit/Source/WebCore/rendering/RenderBoxModelObject.cpp:277
#4  0x00000000015d11a1 in WebCore::RenderBox::destroy (this=0x7fffc1306018) at third_party/WebKit/Source/WebCore/rendering/RenderBox.cpp:211
#5  0x0000000001589f54 in WebCore::RenderBlock::destroy (this=0x7fffc1306018) at third_party/WebKit/Source/WebCore/rendering/RenderBlock.cpp:193
#6  0x000000000164f884 in WebCore::RenderObjectChildList::destroyLeftoverChildren (this=0x7fffc0b2c768)
    at third_party/WebKit/Source/WebCore/rendering/RenderObjectChildList.cpp:59
#7  0x0000000001589dcc in WebCore::RenderBlock::destroy (this=0x7fffc0b2c6d8) at third_party/WebKit/Source/WebCore/rendering/RenderBlock.cpp:158
#8  0x00000000016e2c27 in WebCore::RenderDetails::destroy (this=0x7fffc0b2c6d8) at third_party/WebKit/Source/WebCore/rendering/RenderDetails.cpp:52
#9  0x0000000000c55d15 in WebCore::Node::detach (this=0x7fffc0b2bb40) at third_party/WebKit/Source/WebCore/dom/Node.cpp:1306
#10 0x0000000000be0cc9 in WebCore::ContainerNode::detach (this=0x7fffc0b2bb40) at third_party/WebKit/Source/WebCore/dom/ContainerNode.cpp:731
#11 0x0000000000c36981 in WebCore::Element::detach (this=0x7fffc0b2bb40) at third_party/WebKit/Source/WebCore/dom/Element.cpp:987
#12 0x0000000000be02af in WebCore::ContainerNode::removeChildren (this=0x7fffc1309990)
    at third_party/WebKit/Source/WebCore/dom/ContainerNode.cpp:536
#13 0x000000000170126a in WebCore::replaceChildrenWithFragment (element=0x7fffc1309990, fragment=..., ec=@0x7fffffffb5cc)
    at third_party/WebKit/Source/WebCore/html/HTMLElement.cpp:322
#14 0x0000000001701602 in WebCore::HTMLElement::setInnerHTML (this=0x7fffc1309990, html=..., ec=@0x7fffffffb5cc)
    at third_party/WebKit/Source/WebCore/html/HTMLElement.cpp:368

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.