To reproduce: 1. visit http://www.apple.com 2. click in Google search field 3. type "a" Assertion fires. When I comment out the assertion there is no visible problem. #0 0x03d5bc04 in WebCore::pushFullyClippedState (stack=@0xbfffe020, node=0x1d3d68e0) at OpenSource/WebCore/editing/TextIterator.cpp:187 #1 0x03d5e39d in WebCore::TextIterator::handleReplacedElement (this=0xbfffe014) at OpenSource/WebCore/editing/TextIterator.cpp:532 #2 0x03d5edae in WebCore::TextIterator::advance (this=0xbfffe014) at OpenSource/WebCore/editing/TextIterator.cpp:339
<rdar://problem/6985329>
*** Bug 26557 has been marked as a duplicate of this bug. ***
I've got a fix for this. I hope to post it soon.
Created attachment 31583 [details] patch, but I haven't written the regression test yet
Created attachment 31599 [details] patch
http://trac.webkit.org/changeset/44901