Summary: | Safari Crashes when opening a JS TreeGrid widget | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Sjoerd Mulder <sjoerdmulder> | ||||||||
Component: | Layout and Rendering | Assignee: | Nobody <webkit-unassigned> | ||||||||
Status: | RESOLVED FIXED | ||||||||||
Severity: | Major | CC: | mitz | ||||||||
Priority: | P1 | Keywords: | HasReduction, InRadar | ||||||||
Version: | 523.x (Safari 3) | ||||||||||
Hardware: | PC | ||||||||||
OS: | All | ||||||||||
URL: | http://demo.backbase.com/current/Backbase_4_1/examples/www.backbase.com.2007.debugger/debugger/index.html | ||||||||||
Bug Depends on: | |||||||||||
Bug Blocks: | 6628 | ||||||||||
Attachments: |
|
Description
Sjoerd Mulder
2007-10-03 09:49:48 PDT
ASSERTION FAILED: !beforeChild || beforeChild->parent()->isRenderBlock() || beforeChild->parent()->isRenderInline() (WebKit/WebCore/rendering/RenderFlow.cpp:90 void WebCore::RenderFlow::addChildWithContinuation(WebCore::RenderObject*, WebCore::RenderObject*)) Created attachment 16525 [details]
Reduction for the assertion failure
This reduction does not crash the release build, but triggers the assertion failure.
Created attachment 16526 [details]
Reduction (will crash)
This also reproduces the crash.
Created attachment 16848 [details]
Fix insertion before a child nested in anonymous table parts
Includes change log and a regression test.
Comment on attachment 16848 [details]
Fix insertion before a child nested in anonymous table parts
r=me
|