manual-tests/remove-input-file-onchange.html crashes again, although the stack trace is different this time: Thread 0 Crashed: 0 com.apple.WebCore 0x011e7bb8 WebCore::RenderObject::repaint(bool) + 108 (RenderObject.cpp:1719) 1 com.apple.WebCore 0x013efa5c WebCore::RenderFileUploadControl::valueChanged() + 128 (RenderFileUploadControl.cpp:99) 2 com.apple.WebCore 0x013ef5f4 WebCore::FileChooser::chooseFile(WebCore::String const&) + 264 (FileChooserMac.mm:146) 3 com.apple.WebCore 0x013ef65c -[OpenPanelController chooseFilename:] + 84 (FileChooserMac.mm:75) 4 com.apple.Safari 0x000a8c18 0x1000 + 687128 5 com.apple.AppKit 0x938f465c -[NSSavePanel(NSSavePanelRuntime) _didEndSheet:returnCode:contextInfo:] + 272 6 com.apple.AppKit 0x938c1424 -[NSSavePanel(NSSavePanelRuntime) ok:] + 288
<rdar://problem/4928646>
Fixed by Maciej in r19252.