| Summary: | Crash inside RenderBlock::layoutRunsAndFloatsInRange in the widow code | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Julien Chaffraix <jchaffraix> | ||||
| Component: | Layout and Rendering | Assignee: | Julien Chaffraix <jchaffraix> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | darin, dino, eric, ojan.autocc, webkit.review.bot | ||||
| Priority: | P2 | ||||||
| Version: | 528+ (Nightly build) | ||||||
| Hardware: | All | ||||||
| OS: | All | ||||||
| Attachments: |
|
||||||
Created attachment 184991 [details]
Proposed blind fix.
Comment on attachment 184991 [details] Proposed blind fix. Clearing flags on attachment: 184991 Committed r141009: <http://trac.webkit.org/changeset/141009> All reviewed patches have been landed. Closing bug. |
We are getting bug reports for a crasher in the widow code. I tried several times to see if I could get a reproduction but unfortunately couldn't. Here is the code involved (line 1663 in RenderBlockLineLayout.cpp): int numLinesHanging = 1; while (lineBox && lineBox != firstLineInBlock && !lineBox->isFirstAfterPageBreak()) { ... } // If there were no breaks in the block, we didn't create any widows. if (!lineBox->isFirstAfterPageBreak() || lineBox == firstLineInBlock) return; The crash is a NULL dereference that happens in the 'if'. The 'while' NULL-checks |lineBox| but the following 'if' doesn't, which makes me think that this is the bug.