Created attachment 251916 [details]
Minimal test case to crash Safari
Steps to reproduce (or see attached minimal test case):
1. Create a document using document.implementation.createHTMLDocument('')
2. Add an image node to this document with both a name and an id attribute.
3. Attempt to remove the name attribute from the image node.
The name attribute is removed. Safari does not crash.
This reproduces in the latest stable Safari (8.0.5) on both OS X and iOS.
Thank you, nice test case!
Created attachment 252190 [details]
Comment on attachment 252190 [details]
Clearing flags on attachment: 252190
Committed r183706: <http://trac.webkit.org/changeset/183706>
All reviewed patches have been landed. Closing bug.