Bug 6069

Summary: Assertion failure in RenderBlock::addChildToFlow during replaceChild
Product: WebKit Reporter: Jeff Lang <jeffplang>
Component: DOMAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: mitz
Priority: P2    
Version: 420+   
Hardware: Mac   
OS: OS X 10.4   
URL: http://sms.linuxpowered.com/~puppiesonacid/scrash/
Attachments:
Description Flags
Don't bother with removing and re-inserting into the same place darin: review+

Description Jeff Lang 2005-12-13 15:40:38 PST
If you view the page, click the down arrow next to Home and then click its up
arrow, Safari crashes.  This may be because it's trying to call
insertBefore(node, node) ?  I'm not for sure.
Comment 1 mitz 2005-12-14 01:03:56 PST
On a debug build, this assert fails:
WebCore/khtml/rendering/render_block.cpp:154: failed assertion `false'
Comment 2 mitz 2005-12-14 02:34:39 PST
The problem turns out to be that if Parent has children A and B (A being B's previous sibling), then 
Parent.replaceChild(A,B) messes up the DOM tree.
Comment 3 mitz 2005-12-14 03:57:59 PST
Created attachment 5076 [details]
Don't bother with removing and re-inserting into the same place
Comment 4 mitz 2005-12-14 04:00:09 PST
Comment on attachment 5076 [details]
Don't bother with removing and re-inserting into the same place

Setting child to 0 instead of iffing the while loop to avoid having to indent
everything.
Comment 5 Darin Adler 2005-12-14 09:41:15 PST
Comment on attachment 5076 [details]
Don't bother with removing and re-inserting into the same place

r=me