Summary: | Crash with Scriptalicious javascript library | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Steven Bredenberg <datasink> | ||||||||||
Component: | Layout and Rendering | Assignee: | Nobody <webkit-unassigned> | ||||||||||
Status: | RESOLVED FIXED | ||||||||||||
Severity: | Major | CC: | mitz | ||||||||||
Priority: | P1 | Keywords: | HasReduction | ||||||||||
Version: | 419.x | ||||||||||||
Hardware: | Mac (PowerPC) | ||||||||||||
OS: | OS X 10.4 | ||||||||||||
URL: | http://www.killsaw.com/safari-crash/ | ||||||||||||
Attachments: |
|
Description
Steven Bredenberg
2007-02-25 05:36:17 PST
Created attachment 13369 [details]
Reduction (will crash when the instructions are followed)
Click "Ready" (notice the incorrect layout), then click "Crash".
Created attachment 13370 [details]
Slightly more general reduction (ditto)
The "foo" div doesn't get marked for layout. The check in layoutBlockChildren() is
// If an element might be affected by the presence of floats, then always mark it for
// layout.
which doesn't cover an object being affected by floats no longer intruding into it.
Created attachment 13371 [details]
Possible fix
This patch fixes the problem, but I'm afraid it adds too many unnecessary layouts. I am going to explore an alternative approach based on detecting the changes to overhang.
Created attachment 13372 [details]
Detect withdrawn floats
Comment on attachment 13372 [details]
Detect withdrawn floats
r=me
|