[Webkit-unassigned] [Bug 99141] Crash in RenderBlock::addChildIgnoringAnonymousColumnBlocks

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=99141





--- Comment #2 from Elliott Sprehn <esprehn at chromium.org>  2012-10-12 10:16:48 PST ---
Created an attachment (id=168444)
 --> (https://bugs.webkit.org/attachment.cgi?id=168444&action=review)
Reduction

This crash reproduces in shipping Safari and Chrome (and the nightlies).

For Safari this crashes both the WebProcess *and* causes the Safari.app to close. This is surprising since I thought they would gracefully recover from renderer crashes. Also note you can get yourself into an awesome crash loop because reopening WebKit.app after the crash restores all your tabs, which still contains the crashing file.

For Chrome this only crashes the tab.

Tested on 10.8.2, Safari 6.0.1 (8536.26.14), Chrome 22.0.1229.79, Chrome 24.0.1293.0 canary, WebKit nightly r131159.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.