[Webkit-unassigned] [Bug 57431] Crash when dynamically adding input fields with certain css and attributes to a div

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=57431


Alexey Proskuryakov <ap at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
           Severity|Critical                    |Normal
           Priority|P2                          |P1
          Component|New Bugs                    |Layout and Rendering
                 CC|                            |aestes at apple.com,
                   |                            |ap at webkit.org,
                   |                            |mitz at webkit.org,
                   |                            |simon.fraser at apple.com,
                   |                            |tkent at chromium.org
     Ever Confirmed|0                           |1




--- Comment #1 from Alexey Proskuryakov <ap at webkit.org>  2011-03-30 10:06:01 PST ---
Could you please attach a self-contained test case to this Bugzilla bug? It's better to have everything pertinent to an issue in one place, not on 3rd party servers.

Asserts with a debug build of ToT:

ASSERTION FAILED: !renderer()
/Users/ap/Safari/OpenSource/Source/WebCore/dom/Node.cpp(1449) : void WebCore::Node::createRendererIfNeeded()
1   WebCore::Node::createRendererIfNeeded()
2   WebCore::Element::attach()
3   WebCore::ContainerNode::attach()
4   WebCore::Element::attach()
5   WebCore::HTMLFormControlElement::attach()
6   WebCore::ContainerNode::appendChild(WTF::PassRefPtr<WebCore::Node>, int&, bool)
7   WebCore::replaceChildrenWithFragment(WebCore::HTMLElement*, WTF::PassRefPtr<WebCore::DocumentFragment>, int&)
8   WebCore::HTMLElement::setInnerHTML(WTF::String const&, int&)
9   WebCore::setJSHTMLElementInnerHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValue)
10  bool JSC::lookupPut<WebCore::JSHTMLElement>(JSC::ExecState*, JSC::Identifier const&, JSC::JSValue, JSC::HashTable const*, WebCore::JSHTMLElement*)
11  void JSC::lookupPut<WebCore::JSHTMLElement, WebCore::JSElement>(JSC::ExecState*, JSC::Identifier const&, JSC::JSValue, JSC::HashTable const*, WebCore::JSHTMLElement*, JSC::PutPropertySlot&)
<...>

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.