A WMLPageState may be reused for a new document, on the same Page object. Thus the "WMLCardElement* activeCard" is not allowed to be stored there, leading to crashes under certain circumstances. Going to past a patch soon, including a reproducable test for this.
Created attachment 34580 [details] Initial patch
Sending WebCore/ChangeLog Adding WebCore/manual-tests/wml/select-onpick-event-crash.wml Sending WebCore/wml/WMLCardElement.cpp Sending WebCore/wml/WMLDoElement.cpp Sending WebCore/wml/WMLDocument.cpp Sending WebCore/wml/WMLDocument.h Sending WebCore/wml/WMLGoElement.cpp Sending WebCore/wml/WMLPageState.cpp Sending WebCore/wml/WMLPageState.h Sending WebCore/wml/WMLPrevElement.cpp Sending WebCore/wml/WMLRefreshElement.cpp Transmitting file data ........... Committed revision 47048. http://trac.webkit.org/changeset/47048