26557 2009-06-19 12:44:18 -0700 Crash in WebCore::pushFullyClippedState due to BitStack size assert 2009-06-19 13:45:20 -0700 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) PC All RESOLVED DUPLICATE 26528 P1 Major --- 0 finnur.webkit webkit-unassigned darin oldest_to_newest 126998 0 finnur.webkit 2009-06-19 12:44:18 -0700 I have reduced the crash to this piece of HTML: <html> <body> <form><input type="text" id="search" /></form> <script type="text/javascript"> document.getElementById("search").setAttribute("type","search"); </script> </body> </html> If you call WebCore::findPlainText(...) specifying any text as parameter, you'll get an ASSERT here: static void pushFullyClippedState(BitStack& stack, Node* node) { ASSERT(stack.size() == depthCrossingShadowBoundaries(node)); ... snip ... } Stepping through this, I see that stack.size() returns 5 but depthCrossingShadowBoundaries returns 6, because it goes through this hierarchy of parent nodes: HTMLDocument HTMLHtmlElement HTMLBodyElement HTMLFormElement HTMLInputElement (shadow parent) TextControlInnerTextElement Darin, if you have something simple you'd like me to try, feel free to suggest changes and I can try it out, formulate a patch and submit it to WebKit. 127005 1 finnur.webkit 2009-06-19 12:54:22 -0700 And, I should mention this bug fix is what seems to have triggered this: https://bugs.webkit.org/show_bug.cgi?id=26364 127024 2 mrowe 2009-06-19 13:45:20 -0700 *** This bug has been marked as a duplicate of 26528 ***