<select id="bomb" onfocus="this.parentNode.removeChild(this)">
<option>Click me to crash WebKit/Safari/Chrome.</option>
This crashes because HTMLSelectElement::menuListDefaultEventHandler retrieves its renderer into a local variable, calls focus() which calls into JS to call the focus event handler, and then uses the renderer. The event handler can cause the renderer to be destroyed.
Created attachment 27506 [details]
Comment on attachment 27506 [details]
Fixed with r40804. Sam talked me into adding a layout test too.
Created attachment 30454 [details]