Steps to reproduce: 1) Visit URL. 2) Hit the "Add Note" button. 3) Hit cancel. 4) *boom*
Created attachment 10861 [details] Crash log
is note "comment"? if so this doesn't have a cancel button and works fine. if not, can you explain more what to do? Also, step 1.5 is log into flickr with a valid flickr or yahoo account
No, "Add Note" is "Add Note", exactly as I said. I'm not sure under what circumstances this button is visible but it may require that you're looking at a "friends" image.
Created attachment 11175 [details] Reduction (will crash) What a mess. Since the textarea contains the selection (thanks to focus()), Document::updateRendering() is invoked under setInnerText. Because of the style change, this deletes the inner div whose text is being set, and things just go downhill from there.
radar 4826741
Created attachment 12576 [details] Fix
Comment on attachment 12576 [details] Fix r=me
Landed in r19006.