If you drag the selection box over the absolutely positioned generated content of a block element Webkit crashes. Reproducible with Safari 2 and latest Webkit Nightly (Mon Apr 30 11:37:42 GMT 2007). Note that the crash reasons for Safari and Webkit are different, but the same actions can be taken to cause the crash.
Created attachment 14285 [details] Webkit Nightly Crash Log
Created attachment 14286 [details] Safari 2 Crash Log
Created attachment 14287 [details] Test Case In the text case click below the red square and hold so you have a text selection I-beam and then drag over the red box up to the text. This will cause the browser to crash.
This occurs with both :before and :after.
Confirmed with r21199.
Neat bug. This was printed to the console: ERROR: No parent frame in transitionToCommitted:, FrameLoadTypeInternal
This assert demonstrates the real problem here: Index: rendering/RenderLayer.cpp =================================================================== --- rendering/RenderLayer.cpp (revision 21246) +++ rendering/RenderLayer.cpp (working copy) @@ -1557,6 +1557,7 @@ // Now determine if the result is inside an anchor; make sure an image map wins if // it already set URLElement and only use the innermost. Node* node = result.innerNode(); + ASSERT(!!insideLayer == !!node); while (node) { // for imagemaps, URLElement is the associated area element not the image itself if (node->isLink() && !result.URLElement() && !node->hasTagName(imgTag)) I'm just not sure how to fix it yet.
<rdar://problem/5183693>
Created attachment 14348 [details] Return the enclosing element for positioned generated content
Comment on attachment 14348 [details] Return the enclosing element for positioned generated content r=me
Committed revision 21276.