Update known crash....

chrome/test/data/reliability/known_crashes.txt

Index: chrome/test/data/reliability/known_crashes.txt
===================================================================
--- chrome/test/data/reliability/known_crashes.txt	(revision 76906)
+++ chrome/test/data/reliability/known_crashes.txt	(working copy)
@@ -169,3 +169,6 @@
 
 # 74796
 PREFIX: wtf::stringimpl::createuninitialized___wtf::stringimpl::create___wtf::stringimpl::create___wtf::string::string___webcore::htmldocument::setcompatibilitymodefromdoctype___webcore::htmlconstructionsite::insertdoctype___webcore::htmltreebuilder::processdoctypetoken___webcore::htmltreebuilder::constructtreefromatomictoken___webcore::htmltreebuilder::constructtreefromtoken___webcore::htmldocumentparser::pumptokenizer___webcore::htmldocumentparser::append___webcore::decodeddatadocumentparser::appendbytes___webcore::documentwriter::adddata___webcore::documentloader::commitdata___webkit::frameloaderclientimpl::committedload___webcore::documentloader::commitload___webcore::documentloader::receiveddata___webcore::mainresourceloader::adddata___webcore::resourceloader::didreceivedata___webcore::mainresourceloader::didreceivedata___webcore::resourceloader::didreceivedata___webcore::resourcehandleinternal::didreceivedata___webkit_glue::weburlloaderimpl::context::onreceiveddata___resourcedispatcher::onreceiveddata___ipc::messagewithtuple<tuple3<int,void *,int> >::dispatch<resourcedispatcher,resourcedispatcher,int,void *,int>___resourcedispatcher::dispatchmessagew___resourcedispatcher::onmessagereceived___childthread::onmessagereceived___runnablemethod<history::historybackend,void (__thiscall history::historybackend::*)(gurl const &),tuple1<gurl> >::run___messageloop::runtask___messageloop::dowork___base::messagepumpdefault::run___messageloop::runinternal___messageloop::run___renderermain___`anonymous namespace'::runnamedprocesstypemain___chromemain___maindllloader::launch___wwinmain_____tmaincrtstartup
+
+# 74926
+PREFIX: webcore::htmltreebuilder::constructtreefromatomictoken___webcore::htmltreebuilder::constructtreefromtoken___webcore::htmldocumentparser::pumptokenizer___webcore::htmldocumentparser::insert___webcore::htmldocumentparser::parsedocumentfragment___webcore::documentfragment::parsehtml___webcore::createfragmentfromsource___webcore::htmlelement::setinnerhtml___webcore::htmlelementinternal::innerhtmlattrsetter___v8::internal::jsobject::setpropertywithcallback___v8::internal::jsobject::setproperty___v8::internal::jsobject::setproperty___v8::internal::storeic::store___v8::internal::storeic_miss