The following html file has 4 alerts that return the values (in order): 0, 0, null, null. Right after this file finished loading my webkit (rev 30267) crashes. <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:athena="http://divmod.org/ns/athena/0.7"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> <script src="http://wirc.10noodles.com/static/j/jquery.js" type="text/javascript" charset="utf-8" /> <title>untitled</title> </head> <body> <div athena:class="foobar">ciao</div> <athena:foobar>wella</athena:foobar> <script type="text/javascript" charset="utf-8"> $(function () { var nsr = function (prefix) { var ns = { "" : 'http://www.w3.org/1999/xhtml', "html" : 'http://www.w3.org/1999/xhtml', "athena": 'http://divmod.org/ns/athena/0.7' }; return ns[prefix.toLowerCase()]; }; alert(document.querySelectorAll('div[athena|class="foobar"]', nsr).length); alert(document.querySelectorAll('athena|foobar', nsr).length); alert(document.querySelector('div[athena|class="foobar"]', nsr)); alert(document.querySelector('athena|foobar', nsr)); }); </script> </body> </html>
Can you please attach the file as an attachment, and attach the crash log for the crash that happens?
Created attachment 19170 [details] testcase as an html file.
Created attachment 19171 [details] Crash report
I found reproducible steps for triggering the crash and filed that separately as bug 17408.
I cannot reproduce the reported crash bug in WebKit r39572. I assume that this bug is fixed since bug 17408 is fixed, isn't it?
I can't repro this crash, and no alerts occur, but this matches Firefox & Chrome. Doesn't look like there is still a bug here, please reopen & attach a new test case if there is still an issue.