See attached test case. I'm investigating a fix.
Created attachment 58345 [details] Patch
Comment on attachment 58345 [details] Patch LayoutTests/fast/events/focus-change-crash-expected.txt:1 + Type something into the first input and press tab. The browser should not crash. nit: Can we insert "PASS" or "SUCCESS" into the document before the test finishes?
<rdar://problem/8080788>
Committed r60984: <http://trac.webkit.org/changeset/60984>
http://trac.webkit.org/changeset/60984 might have broken Chromium Mac Release The following changes are on the blame list: http://trac.webkit.org/changeset/60984 http://trac.webkit.org/changeset/60985
(In reply to comment #4) > Committed r60984: <http://trac.webkit.org/changeset/60984> I added PASSED to the test before landing this patch.