Steps to reproduce: 1. Open the attached HTML using debug version of WebKit. 2. Move your mouse pointer to the text. 3. Observe the browser is crashing with the following message: ASSERTION FAILED: genChild->style()->styleType() == FIRST_LETTER (/Users/yutak/WebKit/WebCore/rendering/RenderObjectChildList.cpp:374 void WebCore::RenderObjectChildList::updateBeforeAfterContent(WebCore::RenderObject*, WebCore::PseudoId, WebCore::RenderObject*)) This is derived from a Chromium bug: http://crbug.com/20686
Created attachment 42171 [details] Test case
Created attachment 42204 [details] Fix assertion falure in RenderObjectChildList::updateBeforeAfterContent().
Created attachment 42205 [details] Fix assertion falure in RenderObjectChildList::updateBeforeAfterContent().
Comment on attachment 42205 [details] Fix assertion falure in RenderObjectChildList::updateBeforeAfterContent(). For an assertion-only change, I don't think a test case is required. The test says "passes if it does not crash", but that's misleading. This only ever asserted, it wouldn't crash in a non-debug build. r=me
Comment on attachment 42205 [details] Fix assertion falure in RenderObjectChildList::updateBeforeAfterContent(). LGTM too. Adding to the commit-queue.
Comment on attachment 42205 [details] Fix assertion falure in RenderObjectChildList::updateBeforeAfterContent(). Clearing flags on attachment: 42205 Committed r50386: <http://trac.webkit.org/changeset/50386>
All reviewed patches have been landed. Closing bug.