Bug 6069

Summary: Assertion failure in RenderBlock::addChildToFlow during replaceChild
Product: WebKit Reporter: Jeff Lang <jeffplang>
Component: DOMAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: mitz
Priority: P2    
Version: 420+   
Hardware: Mac   
OS: OS X 10.4   
URL: http://sms.linuxpowered.com/~puppiesonacid/scrash/
Attachments:
Description Flags
Don't bother with removing and re-inserting into the same place darin: review+

Jeff Lang
Reported 2005-12-13 15:40:38 PST
If you view the page, click the down arrow next to Home and then click its up arrow, Safari crashes. This may be because it's trying to call insertBefore(node, node) ? I'm not for sure.
Attachments
Don't bother with removing and re-inserting into the same place (4.43 KB, patch)
2005-12-14 03:57 PST, mitz 		darin: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
mitz
Comment 1 2005-12-14 01:03:56 PST
On a debug build, this assert fails: WebCore/khtml/rendering/render_block.cpp:154: failed assertion `false'
mitz
Comment 2 2005-12-14 02:34:39 PST
The problem turns out to be that if Parent has children A and B (A being B's previous sibling), then Parent.replaceChild(A,B) messes up the DOM tree.
mitz
Comment 3 2005-12-14 03:57:59 PST
Created attachment 5076 [details] Don't bother with removing and re-inserting into the same place
mitz
Comment 4 2005-12-14 04:00:09 PST
Comment on attachment 5076 [details] Don't bother with removing and re-inserting into the same place Setting child to 0 instead of iffing the while loop to avoid having to indent everything.
Darin Adler
Comment 5 2005-12-14 09:41:15 PST
Comment on attachment 5076 [details] Don't bother with removing and re-inserting into the same place r=me
Note You need to log in before you can comment on or make changes to this bug.