Bug 147704 – Crash when removing children of a MathMLSelectElement

• Status: RESOLVED
• Resolution: FIXED
• Component: MathML

[Chris Dumez]

Crash when removing children of a MathMLSelectElement:
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x00007fff90cf0ef9 WebCore::MathMLSelectElement::updateSelectedChild() + 73
1   com.apple.WebCore             	0x00007fff90cf0f42 WebCore::MathMLSelectElement::childrenChanged(WebCore::ContainerNode::ChildChange const&) + 18
2   com.apple.WebCore             	0x00007fff90252198 WebCore::ContainerNode::removeChildren() + 1064
3   com.apple.WebCore             	0x00007fff90ce9eda WebCore::replaceChildrenWithFragment(WebCore::ContainerNode&, WTF::PassRefPtr<WebCore::DocumentFragment>, int&) + 74
4   com.apple.WebCore             	0x00007fff90759f94 WebCore::Element::setInnerHTML(WTF::String const&, int&) + 116
5   com.apple.WebCore             	0x00007fff90a4ffa5 WebCore::setJSElementInnerHTML(JSC::ExecState*, JSC::JSObject*, long long, long long) + 117

[Chris Dumez]

rdar://problem/21940321

[Chris Dumez]

Created attachment 258317 [details]
Patch

[Ryosuke Niwa]

Comment on attachment 258317 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=258317&action=review

> LayoutTests/mathml/maction-removeChild.html:15
> +      var testSelect = document.getElementById("testSelect");
> +      testSelect.innerHTML = "123.123.123";

Can we just turn this into a text test by calling testRunner.dumpAsText()?

[Chris Dumez]

Created attachment 258320 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 258320 [details]
Patch

Clearing flags on attachment: 258320

Committed r188014: <http://trac.webkit.org/changeset/188014>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.