Bug 12886 - Crash with Scriptalicious javascript library
Summary: Crash with Scriptalicious javascript library
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 419.x
Hardware: Mac (PowerPC) OS X 10.4
: P1 Major
Assignee: Nobody
URL: http://www.killsaw.com/safari-crash/
Keywords: HasReduction
Depends on:
Blocks:
 
Reported: 2007-02-25 05:36 PST by Steven Bredenberg
Modified: 2007-02-25 21:43 PST (History)
1 user (show)

See Also:


Attachments
Reduction (will crash when the instructions are followed) (641 bytes, text/html)
2007-02-25 10:38 PST, mitz
no flags Details
Slightly more general reduction (ditto) (691 bytes, text/html)
2007-02-25 11:15 PST, mitz
no flags Details
Possible fix (35.09 KB, patch)
2007-02-25 14:08 PST, mitz
no flags Details | Formatted Diff | Diff
Detect withdrawn floats (33.25 KB, patch)
2007-02-25 14:50 PST, mitz
hyatt: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Steven Bredenberg 2007-02-25 05:36:17 PST
Reliably crashes the version of Safari that ships with Tiger in addition to the most recent nightly build. I'm running OSX 10.4.8.
Comment 1 mitz 2007-02-25 10:38:11 PST
Created attachment 13369 [details]
Reduction (will crash when the instructions are followed)

Click "Ready" (notice the incorrect layout), then click "Crash".
Comment 2 mitz 2007-02-25 11:15:25 PST
Created attachment 13370 [details]
Slightly more general reduction (ditto)

The "foo" div doesn't get marked for layout. The check in layoutBlockChildren() is
        // If an element might be affected by the presence of floats, then always mark it for
        // layout.
which doesn't cover an object being affected by floats no longer intruding into it.
Comment 3 mitz 2007-02-25 14:08:03 PST
Created attachment 13371 [details]
Possible fix

This patch fixes the problem, but I'm afraid it adds too many unnecessary layouts. I am going to explore an alternative approach based on detecting the changes to overhang.
Comment 4 mitz 2007-02-25 14:50:03 PST
Created attachment 13372 [details]
Detect withdrawn floats
Comment 5 Dave Hyatt 2007-02-25 18:02:33 PST
Comment on attachment 13372 [details]
Detect withdrawn floats

r=me
Comment 6 Mark Rowe (bdash) 2007-02-25 21:43:07 PST
Landed in r19852.