45713 2010-09-13 15:31:34 -0700 Regression: crash in nightlies and Chrome 7.0.517 on object.removeAttribute("type") 2011-02-24 23:09:56 -0800 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) PC All RESOLVED WORKSFORME http://aryeh.name/tests/reflection.html P2 Normal --- 0 ayg webkit-unassigned tabatkins oldest_to_newest 278531 0 ayg 2010-09-13 15:31:34 -0700 http://aryeh.name/tests/reflection.html Visit the page, and after a few seconds you get a sad tab in Chrome/crash in Safari. This didn't happen before my last Chrome update (to 7.0.517), and happens for Chrome on both Windows and Linux. It also happens in the r66933 and r67357 nightly builds for Windows, at least. I don't think I can test in earlier nightly builds because of bug 44968. It doesn't happen in Safari 5. I might change the tests before you see this, so you can get a frozen version of the test page from git if the version at the URL right now isn't showing the problem: http://aryeh.name/gitweb.cgi?p=tests;a=blob;f=reflection.html;hb=d18713d86 If I can provide any additional info, please advise. 280707 1 ayg 2010-09-17 10:15:42 -0700 Minimal test case: data:text/html,<!doctype html> <script> var el = document.createElement("object"); el.type = ""; el.removeAttribute("type"); </script> This causes a sad tab for me in Chrome dev, and a crash in the latest WebKit nightly (r67637). 357106 2 tabatkins 2011-02-24 09:38:15 -0800 No longer appears to cause a sad tab or crash for me. Aryeh, wanna double-check and invalidate this if necessary? 357566 3 ayg 2011-02-24 16:48:23 -0800 Nope, can't reproduce anymore.