This crash is reproducible in Safari 3.2.1 (4525.27.1) on Macintosh and Safari 3.1.2 and Chrome 188.8.131.52 on Windows.
When using jQuery's show/hide, slideup/slidedown animations on a div with fixed positioning, the browser will crash.
See the URL for a test case reduction. If you require any further information just let me know and I will provide it.
Created attachment 29772 [details]
test case reduction
Created attachment 29780 [details]
ASSERTION FAILED: !node() || documentBeingDestroyed() || !document()->frame()->view() || document()->frame()->view()->layoutRoot() != this
(/Users/Cameron/WebKit/WebCore/rendering/RenderObject.cpp:210 virtual WebCore::RenderObject::~RenderObject())
This may be related to bug 25252.
Actually, it appears before the revision causing bug 25252, and the bug mentions this. I'm stupid.
Created attachment 34722 [details]
reduction to 418byte from 3kb
reduction to 418byte.
Created attachment 34919 [details]
testcase without jquery dependancy. always reproducable.
This reproduces with Safari 4.0.4, but not with ToT.
I don't know if there was an appropriate regression test landed with a fix, so it's likely easiest to land this test.
Created attachment 43609 [details]
Comment on attachment 43609 [details]
Is there no way to make the test effective without all the timeouts? Could we force layout instead?
It's irritating to have timeouts in a test.
Actually, forcing layout does work! I was too intimidated with this layout and rendering bug to try :)
Landed a test without timeouts in <http://trac.webkit.org/changeset/51254>.