If I wget http://slashdot.org/ and just open it in a WebKit-based browser, everything is OK; of course, JavaScript loaded by relative URLs is not working. If I open http://slashdot.org/ in a webkit browser built against latest nightly (I tried two different browsers - uzbl and midori, both have the same regression when the same browser code is linked against too fresh WebKit instead of slightly older one), I see the Slashdot scripts composing a page, for a brief moment I even see nearly-complete rendering and then browser crashes.
Maybe I misclassified the bug because disabling one CSS file ( http://c.fsdn.com/sd/idlecore-tidied.css?T_2_5_0_266b ) fixes the problem. Bug was first filed when r46770 was fresh nightly. It appeared a few days earlier. gdb reports WebCore::RenderFieldset::findLegend Full backtrace minus paths and application part: #0 0xb7a0b9bf in WebCore::RenderFieldset::findLegend () #1 0xb7a0c83d in WebCore::RenderFieldset::calcPrefWidths () #2 0xb79f6d9b in WebCore::RenderBox::minPrefWidth () #3 0xb7a003d3 in WebCore::RenderBox::calcWidth () #4 0xb79e8cba in WebCore::RenderBlock::layoutBlock () #5 0xb79d6b18 in WebCore::RenderBlock::layout () #6 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren () #7 0xb79e9311 in WebCore::RenderBlock::layoutBlock () #8 0xb79d6b18 in WebCore::RenderBlock::layout () #9 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren () #10 0xb79e9311 in WebCore::RenderBlock::layoutBlock () #11 0xb79d6b18 in WebCore::RenderBlock::layout () #12 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren () #13 0xb79e9311 in WebCore::RenderBlock::layoutBlock () #14 0xb79d6b18 in WebCore::RenderBlock::layout () #15 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren () #16 0xb79e9311 in WebCore::RenderBlock::layoutBlock () #17 0xb79d6b18 in WebCore::RenderBlock::layout () #18 0xb79d896c in WebCore::RenderBlock::insertFloatingObject () #19 0xb79e3377 in WebCore::RenderBlock::handleFloatingChild () #20 0xb79e6313 in WebCore::RenderBlock::handleSpecialChild () #21 0xb79e84b9 in WebCore::RenderBlock::layoutBlockChildren () #22 0xb79e9311 in WebCore::RenderBlock::layoutBlock () #23 0xb79d6b18 in WebCore::RenderBlock::layout () #24 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren () #25 0xb79e9311 in WebCore::RenderBlock::layoutBlock () #26 0xb79d6b18 in WebCore::RenderBlock::layout () #27 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren () #28 0xb79e9311 in WebCore::RenderBlock::layoutBlock () #29 0xb79d6b18 in WebCore::RenderBlock::layout () #30 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren () #31 0xb79e9311 in WebCore::RenderBlock::layoutBlock () #32 0xb79d6b18 in WebCore::RenderBlock::layout () #33 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren () #34 0xb79e9311 in WebCore::RenderBlock::layoutBlock () #35 0xb79d6b18 in WebCore::RenderBlock::layout () #36 0xb7a6ff17 in WebCore::RenderView::layout () #37 0xb7932682 in WebCore::FrameView::layout () #38 0xb773c250 in WebCore::Document::updateLayout () #39 0xb774f5d9 in WebCore::Document::updateLayoutIgnorePendingStylesheets () #40 0xb76b684b in WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue () #41 0xb76bcf98 in WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue () #42 0xb76b5446 in WebCore::CSSComputedStyleDeclaration::getPropertyValue () #43 0xb76f6353 in WebCore::CSSStyleDeclaration::getPropertyValue () #44 0xb7cb66c4 in WebCore::jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue ()
Still crashes in r46809 nightly (just in case..)
Simple reduction (derived from slashdot.org). <form> tag can be added if you wish so. <html> <head> <style> label{display:block;} </style> </head> <body> <fieldset> <label></label> a </fieldset> </body> </html>
Created attachment 34261 [details] Reduction for slashdot.org crash <form> tag around <fieldset> is omitted for brevity. It would make no difference.
Further investigating: it only ocurs when WML support was enabled during the build.
CC'ing Nikolas as he knows more about WML.
I believe this is a regression of a bug that was fixed before. It's platform independent.
Created attachment 34908 [details] Patch and testcase to fix the bug
Bug # can be added when landing. It's in my local tree.
(In reply to comment #9) > Bug # can be added when landing. It's in my local tree. Looks ok. r=me.
Checked in r47329