Bug 6069 - Assertion failure in RenderBlock::addChildToFlow during replaceChild
Summary: Assertion failure in RenderBlock::addChildToFlow during replaceChild
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 420+
Hardware: Mac OS X 10.4
: P2 Normal
Assignee: Nobody
URL: http://sms.linuxpowered.com/~puppieso...
Keywords:
Depends on:
Blocks:
 
Reported: 2005-12-13 15:40 PST by Jeff Lang
Modified: 2005-12-16 08:11 PST (History)
1 user (show)

See Also:


Attachments
Don't bother with removing and re-inserting into the same place (4.43 KB, patch)
2005-12-14 03:57 PST, mitz
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Jeff Lang 2005-12-13 15:40:38 PST
If you view the page, click the down arrow next to Home and then click its up
arrow, Safari crashes.  This may be because it's trying to call
insertBefore(node, node) ?  I'm not for sure.
Comment 1 mitz 2005-12-14 01:03:56 PST
On a debug build, this assert fails:
WebCore/khtml/rendering/render_block.cpp:154: failed assertion `false'
Comment 2 mitz 2005-12-14 02:34:39 PST
The problem turns out to be that if Parent has children A and B (A being B's previous sibling), then 
Parent.replaceChild(A,B) messes up the DOM tree.
Comment 3 mitz 2005-12-14 03:57:59 PST
Created attachment 5076 [details]
Don't bother with removing and re-inserting into the same place
Comment 4 mitz 2005-12-14 04:00:09 PST
Comment on attachment 5076 [details]
Don't bother with removing and re-inserting into the same place

Setting child to 0 instead of iffing the while loop to avoid having to indent
everything.
Comment 5 Darin Adler 2005-12-14 09:41:15 PST
Comment on attachment 5076 [details]
Don't bother with removing and re-inserting into the same place

r=me