[Webkit-unassigned] [Bug 212714] Release Assert @ WebCore::RenderTreeBuilder::RenderTreeBuilder

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=212714

--- Comment #36 from Alexey Proskuryakov <ap at webkit.org> ---
Comment on attachment 401808
  --> https://bugs.webkit.org/attachment.cgi?id=401808
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=401808&action=review

> LayoutTests/fast/rendering/widget-removal-in-render-tree-builder-crash.html:38
> +<details id="z" open="true" ontoggle="runTest()">a</details>

I am still very skeptical of running test JS in the middle of parsing. Not blocking review, but this could be worth some more effort.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200613/ee3bbd89/attachment.htm>