Crash when removing children of a MathMLSelectElement: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x00007fff90cf0ef9 WebCore::MathMLSelectElement::updateSelectedChild() + 73 1 com.apple.WebCore 0x00007fff90cf0f42 WebCore::MathMLSelectElement::childrenChanged(WebCore::ContainerNode::ChildChange const&) + 18 2 com.apple.WebCore 0x00007fff90252198 WebCore::ContainerNode::removeChildren() + 1064 3 com.apple.WebCore 0x00007fff90ce9eda WebCore::replaceChildrenWithFragment(WebCore::ContainerNode&, WTF::PassRefPtr<WebCore::DocumentFragment>, int&) + 74 4 com.apple.WebCore 0x00007fff90759f94 WebCore::Element::setInnerHTML(WTF::String const&, int&) + 116 5 com.apple.WebCore 0x00007fff90a4ffa5 WebCore::setJSElementInnerHTML(JSC::ExecState*, JSC::JSObject*, long long, long long) + 117
rdar://problem/21940321
Created attachment 258317 [details] Patch
Comment on attachment 258317 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=258317&action=review > LayoutTests/mathml/maction-removeChild.html:15 > + var testSelect = document.getElementById("testSelect"); > + testSelect.innerHTML = "123.123.123"; Can we just turn this into a text test by calling testRunner.dumpAsText()?
Created attachment 258320 [details] Patch
Comment on attachment 258320 [details] Patch Clearing flags on attachment: 258320 Committed r188014: <http://trac.webkit.org/changeset/188014>
All reviewed patches have been landed. Closing bug.