WebKit throws ASSERT for this html: <html> <body> <ol start="3888" type="i"> <li>Foo </li> </ol> </body> </html> Posting one potential fix and a layout test soon.
Created attachment 43470 [details] potential fix for assert
Comment on attachment 43470 [details] potential fix for assert This should be a dumpAsText() test since it is just testing for a crash. The test should say something like: PASS: this test did not crash, bug 31652 for the output.
Created attachment 43507 [details] patch with updated layout test
Comment on attachment 43507 [details] patch with updated layout test Clearing flags on attachment: 43507 Committed r51201: <http://trac.webkit.org/changeset/51201>
All reviewed patches have been landed. Closing bug.