To reproduce, navigate to the URL. Result: ASSERTION FAILED: m_text Source/WebCore/rendering/RenderText.cpp(142) : WebCore::RenderText::RenderText(WebCore::Node *, PassRefPtr<WTF::StringImpl>) 1 0x104917beb WebCore::RenderText::RenderText(WebCore::Node*, WTF::PassRefPtr<WTF::StringImpl>) 2 0x10492862f WebCore::RenderTextFragment::RenderTextFragment(WebCore::Node*, WTF::StringImpl*) 3 0x1049285d5 WebCore::RenderTextFragment::RenderTextFragment(WebCore::Node*, WTF::StringImpl*) 4 0x104877c2d WebCore::RenderObjectChildList::updateBeforeAfterContent(WebCore::RenderObject*, WebCore::PseudoId, WebCore::RenderObject const*) 5 0x104753cca WebCore::RenderBlock::updateBeforeAfterContent(WebCore::PseudoId) 6 0x1047536e1 WebCore::RenderBlock::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) 7 0x104871652 WebCore::RenderObject::setStyle(WTF::PassRefPtr<WebCore::RenderStyle>) 8 0x104870e1a WebCore::RenderObject::setAnimatableStyle(WTF::PassRefPtr<WebCore::RenderStyle>) 9 0x1046b3fb8 WebCore::NodeRendererFactory::createRenderer() 10 0x1046b4273 WebCore::NodeRendererFactory::createRendererIfNeeded() 11 0x10469a895 WebCore::Node::createRendererIfNeeded() 12 0x103ddecd0 WebCore::Element::attach() 13 0x103a5188a WebCore::ContainerNode::attach() 14 0x103dded0a WebCore::Element::attach() 15 0x1039fdd76 WebCore::Node::reattach() 16 0x103ddf599 WebCore::Element::recalcStyle(WebCore::Node::StyleChange) 17 0x103ddfc81 WebCore::Element::recalcStyle(WebCore::Node::StyleChange) 18 0x103ddfc81 WebCore::Element::recalcStyle(WebCore::Node::StyleChange) 19 0x103c14914 WebCore::Document::recalcStyle(WebCore::Node::StyleChange) 20 0x103c15879 WebCore::Document::updateStyleIfNeeded() 21 0x103c15a26 WebCore::Document::updateLayout() 22 0x103c15bc4 WebCore::Document::updateLayoutIgnorePendingStylesheets() 23 0x103ddc027 WebCore::Element::offsetHeight() 24 0x10428815f WebCore::jsElementOffsetHeight(JSC::ExecState*, JSC::JSValue, JSC::Identifier const&) 25 0x101a96b11 JSC::PropertySlot::getValue(JSC::ExecState*, JSC::Identifier const&) const 26 0x101aa5fda JSC::JSValue::get(JSC::ExecState*, JSC::Identifier const&, JSC::PropertySlot&) const 27 0x101bb59d5 cti_op_get_by_id_self_fail 28 0x101bc3460 jscGeneratedNativeCode 29 0x101b88b79 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*) 30 0x101b85006 JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::ScopeChainNode*, JSC::JSObject*) 31 0x101b03dda JSC::evaluate(JSC::ExecState*, JSC::ScopeChainNode*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*)
Created attachment 112788 [details] web archive Attaching a web archive, as this is not always reproducible at the URL.
Created attachment 112791 [details] Reduction
Created attachment 112795 [details] Use an empty string instead of a null string in the missing attribute case
Fixed in <http://trac.webkit.org/r98675>.