If a HTML form control is deleted while its HTML popup is open, the popup will reference the element on close a crash. Add a guard. Testcase will be attached but I haven't found a way to automate this for layout tests yet.
Created attachment 171687 [details] Test case
Created attachment 171688 [details] Patch
Comment on attachment 171688 [details] Patch Clearing flags on attachment: 171688 Committed r133102: <http://trac.webkit.org/changeset/133102>
All reviewed patches have been landed. Closing bug.