Bug 68550

Summary: REGRESSION: Crash in RenderBlock::removeFloatingObjectsBelow()
Product: WebKit Reporter: mitz
Component: Layout and RenderingAssignee: mitz
Status: RESOLVED FIXED    
Severity: Normal Keywords: InRadar, Regression
Priority: P1    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Test case (will crash)
none
Check if the floating object set has become empty darin: review+

Description mitz 2011-09-21 11:23:08 PDT
Created attachment 108189 [details]
Test case (will crash)

<rdar://problem/9768483>

The attached test case causes WebKit to crash in RenderBlock::removeFloatingObjectsBelow(). Patch forthcoming.
Comment 1 mitz 2011-09-21 11:35:42 PDT
Created attachment 108195 [details]
Check if the floating object set has become empty
Comment 2 mitz 2011-09-21 11:45:48 PDT
Fixed in <http://trac.webkit.org/r95654>.