You need a slow-loading image in order to reporduce this crash. Open the image URL, and when you start seeing part of the image, but before it finishes loading, go to a different (fast-loading) URL. As the new document is received, you get a crash in RenderBox::calcWidth(), due to dereferencing a null view() pointer. I have a patch, but no test yet.
Created attachment 9800 [details] Patch, still no test or change log Other classes' imageChanged() implementations seem safe.
Created attachment 10766 [details] Same old patch, but with a change log I tried to make an http+navigationController test for this, but with the current DumpRenderTree functionality (and even with some additions) I couldn't get it to crash.
Comment on attachment 10766 [details] Same old patch, but with a change log r=me
Committed revision 16697.