Bug 15362 – Safari Crashes when opening a JS TreeGrid widget

• Status: RESOLVED
• Resolution: FIXED
• Component: Layout and Rendering

[Sjoerd Mulder]

Reproducable: always

Howto reproduce: 1. Goto http://demo.backbase.com/current/Backbase_4_1/examples/www.backbase.com.2007.debugger/debugger/index.html
2. After the page is loaded press ESC to open the Backbase Debugger
3. Click on some Treenode on the left of the window to select it.
4. Now at the right side you see the 'DOM Node' properties.
5. Try to Expand the Properties => tagName property => CRASH

This happens ALWAYS, the code behind the Treegrid is quite simple, it's generates some TR's and does insertBefore on the TBODY with the current TR as reference. This doesnt happen when the Grid is in some other container (e.g. for example in the Console Tab)

ASSERTION FAILED: !beforeChild || beforeChild->parent()->isRenderBlock() || beforeChild->parent()->isRenderInline()
(WebKit/WebCore/rendering/RenderFlow.cpp:90 void WebCore::RenderFlow::addChildWithContinuation(WebCore::RenderObject*, WebCore::RenderObject*))

Created attachment 16525 [details]
Reduction for the assertion failure

This reduction does not crash the release build, but triggers the assertion failure.

Created attachment 16526 [details]
Reduction (will crash)

This also reproduces the crash.

[Mark Rowe (bdash)]

<rdar://problem/5558715>

Created attachment 16848 [details]
Fix insertion before a child nested in anonymous table parts

Includes change log and a regression test.

[Dave Hyatt]

Comment on attachment 16848 [details]
Fix insertion before a child nested in anonymous table parts

r=me

Fixed in <http://trac.webkit.org/projects/webkit/changeset/27051>.