Reproducable: always Howto reproduce: 1. Goto http://demo.backbase.com/current/Backbase_4_1/examples/www.backbase.com.2007.debugger/debugger/index.html 2. After the page is loaded press ESC to open the Backbase Debugger 3. Click on some Treenode on the left of the window to select it. 4. Now at the right side you see the 'DOM Node' properties. 5. Try to Expand the Properties => tagName property => CRASH This happens ALWAYS, the code behind the Treegrid is quite simple, it's generates some TR's and does insertBefore on the TBODY with the current TR as reference. This doesnt happen when the Grid is in some other container (e.g. for example in the Console Tab)
ASSERTION FAILED: !beforeChild || beforeChild->parent()->isRenderBlock() || beforeChild->parent()->isRenderInline() (WebKit/WebCore/rendering/RenderFlow.cpp:90 void WebCore::RenderFlow::addChildWithContinuation(WebCore::RenderObject*, WebCore::RenderObject*))
Created attachment 16525 [details] Reduction for the assertion failure This reduction does not crash the release build, but triggers the assertion failure.
Created attachment 16526 [details] Reduction (will crash) This also reproduces the crash.
<rdar://problem/5558715>
Created attachment 16848 [details] Fix insertion before a child nested in anonymous table parts Includes change log and a regression test.
Comment on attachment 16848 [details] Fix insertion before a child nested in anonymous table parts r=me
Fixed in <http://trac.webkit.org/projects/webkit/changeset/27051>.