The following test fails with the error line 14:41 : TypeError: null is not an object (evaluating 'frame.children[i].firstChild.innerHTML = "test"') The DOM tree seems to be corrupted after an innerHTML. <html> <head></head> <body> <div id="frame"> <div><div></div></div> <div><div></div></div> <div><div></div></div> <div><div></div></div> <div><div></div></div> </div> <script type="text/javascript"> frame = document.getElementById("frame"); for (var i = 0; i < frame.children.length; i++) frame.children[i].firstChild.innerHTML = "test"; </script> </body> </html>
<rdar://problem/15437790>
Created attachment 217151 [details] patch
Comment on attachment 217151 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=217151&action=review > Source/WebCore/ChangeLog:12 > + Reducation by yannick.poirier@inverto.tv. Reduction?
https://trac.webkit.org/r159389
Thanks for the bug report and good reduction Yannick!