[Webkit-unassigned] [Bug 56773] REGRESSION(81035): crash in RenderDetails::removeChild

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=56773





--- Comment #1 from James Robinson <jamesr at chromium.org>  2011-03-21 15:36:20 PST ---
innerHTML is being set on a <section> that contains a <details> element. Here's the showTree() output for the node that innerHTML is being set on immediately before the crash:

*            SECTION    0x7fffc0e783f0 CLASS=WikiaPagesOnWikiModule module
                #text    0x7fffc0e7bf50 "\n    "
                H1    0x7fffc0e78360
                    #text    0x7fffc0e7bee0 "Pages on RuneScape Wiki"
                #text    0x7fffc0e7be70 "\n    "
                A    0x7fffc1f5f000 CLASS=wikia-button createpage
                    IMG    0x7fffc0e7ec40 CLASS=sprite new
                    #text    0x7fffc1473a80 "Add a Page"
                #text    0x7fffc1473a10 "    "
                DETAILS    0x7fffc1474f00 CLASS=tally
                    #text    0x7fffc1473770 "\n        "
                    EM    0x7fffc0e78240
                        #text    0x7fffc1473700 "17,135"
                    SPAN    0x7fffc0e781b0 CLASS=fixedwidth
                        #text    0x7fffc1473620 "pages on this wiki"
                    #text    0x7fffc14735b0 "    "
                #text    0x7fffc1473540 "\n"

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.