This happens because http://trac.webkit.org/changeset/123281 broke table's childNodes implementation. Here is a reduction: // Initialize table table = document.createElement("table"); for (var i = 0; i<3;++i) { tr = document.createElement("tr"); td = document.createElement("td"); tr.appendChild(td); table.appendChild(tr); } // lastElement value is incorrect (td instead of tr). lastElement = table.childNodes[table.childNodes.length - 1]; // This code fixes the bug. for (var i = 0; i<table.childNodes.length;++i) var tmp = table.childNodes[i]; // lastElement2 value is correct. lastElement2 = table.childNodes[table.childNodes.length - 1]; console.log(lastElement.tagName); console.log(lastElement2.tagName); console.assert(lastElement === lastElement2); // <-- this assertion fails.
Does this bug reproduce after http://trac.webkit.org/changeset/123359 ?
(In reply to comment #1) > Does this bug reproduce after http://trac.webkit.org/changeset/123359 ? There was widespread breakage of internal tools at Google after http://trac.webkit.org/changeset/123281, but http://trac.webkit.org/changeset/123359 seems to have fixed them all.
Indeed, it doesn't reproduce on ToT.