Bug 19598

Summary: Crash in WebCore::RenderBlock::determineStartPosition
Product: WebKit Reporter: Tony Arnold <tony>
Component: Layout and RenderingAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: mitz
Priority: P1 Keywords: HasReduction
Version: 528+ (Nightly build)   
Hardware: Mac   
OS: OS X 10.5   
Attachments:
Description Flags
This is the crash log of the reported bug.
none
Reduction (will crash)
none
Patch darin: review+

Description Tony Arnold 2008-06-16 23:21:59 PDT
When trying to use the admin panels of Symphony (http://21degrees.com.au/products/symphony/), the latest builds of WebKit crash. I have attached the crash log.
Comment 1 Tony Arnold 2008-06-16 23:36:39 PDT
Created attachment 21752 [details]
This is the crash log of the reported bug.
Comment 2 mitz 2008-06-17 00:40:28 PDT
ASSERTION FAILED: floatIndex < floats.size()
(WebCore/rendering/bidi.cpp:1169 WebCore::RootInlineBox* WebCore::RenderBlock::determineStartPosition(bool&, WebCore::BidiState&, WTF::Vector<WebCore::RenderBlock::FloatWithRect, 0ul>&, unsigned int&))
Comment 3 mitz 2008-06-17 13:50:02 PDT
Created attachment 21763 [details]
Reduction (will crash)
Comment 4 mitz 2008-06-17 17:49:17 PDT
Created attachment 21803 [details]
Patch
Comment 5 Darin Adler 2008-06-18 19:53:25 PDT
Comment on attachment 21803 [details]
Patch

r=me
Comment 6 mitz 2008-06-18 20:02:44 PDT
Landed in <http://trac.webkit.org/changeset/34654>.