If you view the page, click the down arrow next to Home and then click its up arrow, Safari crashes. This may be because it's trying to call insertBefore(node, node) ? I'm not for sure.
On a debug build, this assert fails: WebCore/khtml/rendering/render_block.cpp:154: failed assertion `false'
The problem turns out to be that if Parent has children A and B (A being B's previous sibling), then Parent.replaceChild(A,B) messes up the DOM tree.
Created attachment 5076 [details] Don't bother with removing and re-inserting into the same place
Comment on attachment 5076 [details] Don't bother with removing and re-inserting into the same place Setting child to 0 instead of iffing the while loop to avoid having to indent everything.
Comment on attachment 5076 [details] Don't bother with removing and re-inserting into the same place r=me