In Chromium on Mac, open the attached page. Click the select, select an item. Chromium crashes. Notes: This happens because the select element removes himself from the DOM on the onchange event.
Created attachment 73134 [details] Test page to recreate the crasher.
Created attachment 73165 [details] Patch
Comment on attachment 73165 [details] Patch LGTM
Comment on attachment 73165 [details] Patch Clearing flags on attachment: 73165 Committed r71480: <http://trac.webkit.org/changeset/71480>
All reviewed patches have been landed. Closing bug.
I hope a test a was added somewhere.
@levin Yes, we have a test for this in the Chromium tree https://bugs.webkit.org/show_bug.cgi?id=49108 It will go in as soon as this patch makes it to the Chromium tree.