This is for chromium only. Regression from http://trac.webkit.org/changeset/52001 If user accepts an item from dropdown list, m_acceptedIndexOnAbandon is not cleared and the dropdown will crash if it is destroyed. This is To repro: 1) http://code.google.com/p/chromium/issues/entry 2) Select the "template" drop-down 3) Hit B, Hit <enter> 4) Boom
Created attachment 46318 [details] proposed patch
Comment on attachment 46318 [details] proposed patch r=me.
Comment on attachment 46318 [details] proposed patch cq, take it away.
Comment on attachment 46318 [details] proposed patch Clearing flags on attachment: 46318 Committed r53113: <http://trac.webkit.org/changeset/53113>
All reviewed patches have been landed. Closing bug.