This was reported upstream to Chromium by way of PVS Studio ( http://www.viva64.com/en/b/0113/ ), Fragment N11 http://trac.webkit.org/browser/trunk/Source/WebCore/accessibility/AccessibilityObject.cpp?annotate=blame&rev=96973#L481 Line 487: while (true) { tempPosition = startPosition.previous(); if (tempPosition.isNull() || tempPosition.isNull()) break; Position p = tempPosition.deepEquivalent(); The bug is that the conditional checks if tempPosition.isNull() twice. It's not clear what is meant to be checked here - startPosition.isNull() ? It was introduced in http://trac.webkit.org/changeset/92451
Ok, this is definitely a typo. The second isNull check is redundant and can be removed.
Created attachment 111023 [details] cleanup
Comment on attachment 111023 [details] cleanup r=me
Comment on attachment 111023 [details] cleanup Clearing flags on attachment: 111023 Committed r97479: <http://trac.webkit.org/changeset/97479>
All reviewed patches have been landed. Closing bug.