Summary: | -webkit-box-reflect in hyperlink causes webkit to crash | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Trevor Downs <cyberskull> | ||||||||||
Component: | CSS | Assignee: | Nobody <webkit-unassigned> | ||||||||||
Status: | RESOLVED FIXED | ||||||||||||
Severity: | Normal | CC: | mitz | ||||||||||
Priority: | P1 | Keywords: | InRadar | ||||||||||
Version: | 528+ (Nightly build) | ||||||||||||
Hardware: | Mac (PowerPC) | ||||||||||||
OS: | OS X 10.5 | ||||||||||||
Attachments: |
|
Description
Trevor Downs
2008-06-12 15:52:00 PDT
Created attachment 21666 [details]
A FAQ I am performing stylistic cleaning up on.
Created attachment 21667 [details]
Log for one of the crashes.
Created attachment 21668 [details]
Another crash log for this incident
Confirmed with ToT. Debug stack trage: Thread 0 Crashed: 0 com.apple.WebCore 0x0286ad73 WebCore::RenderLayer::reflection() const + 9 (RenderLayer.h:220) 1 com.apple.WebCore 0x02873cff WebCore::RenderBox::computeAbsoluteRepaintRect(WebCore::IntRect&, bool) + 245 (RenderBox.cpp:1104) 2 com.apple.WebCore 0x028bd09a WebCore::RenderObject::computeAbsoluteRepaintRect(WebCore::IntRect&, bool) + 448 (RenderObject.cpp:2013) 3 com.apple.WebCore 0x028edcfd WebCore::RenderText::selectionRect(bool) + 519 (RenderText.cpp:1080) 4 com.apple.WebCore 0x0290b87c WebCore::RenderObject::SelectionInfo::SelectionInfo(WebCore::RenderObject*, bool) + 92 5 com.apple.WebCore 0x0290aabd WebCore::RenderView::setSelection(WebCore::RenderObject*, int, WebCore::RenderObject*, int) + 1467 (RenderView.cpp:357) 6 com.apple.WebCore 0x026062c7 WebCore::Frame::selectionLayoutChanged() + 999 (Frame.cpp:631) 7 com.apple.WebCore 0x02a3d368 WebCore::SelectionController::setSelection(WebCore::Selection const&, bool, bool, bool) + 648 (SelectionController.cpp:143) <rdar://problem/5961768> is essentially the same issue. Created attachment 22291 [details]
Suppress reflections of inline flows
This proved to be hard to do in adjustRenderStyle() because there is no easy way to tell the that element is going to be an inline flow, so instead this patch just overrides the flag on the renderer.
Comment on attachment 22291 [details]
Suppress reflections of inline flows
r=me
Fixed in <http://trac.webkit.org/changeset/35186>. |