Created attachment 188516 [details] Test that crashes It is possible to remove a box from a flow thread right after deleting a region from the chain. Without a layout to rebuild the region ranges for the box, an assertion is hit because some regions still have information about the box. See the test case attached.
Created attachment 188532 [details] Test that crashes v2 The previous test didn't trigger the assert.
Created attachment 188556 [details] Patch
Comment on attachment 188556 [details] Patch r=me
Comment on attachment 188556 [details] Patch Rejecting attachment 188556 [details] from commit-queue. abucur@adobe.com does not have committer permissions according to http://trac.webkit.org/browser/trunk/Tools/Scripts/webkitpy/common/config/committers.py. - If you do not have committer rights please read http://webkit.org/coding/contributing.html for instructions on how to use bugzilla flags. - If you have committer rights please correct the error in Tools/Scripts/webkitpy/common/config/committers.py by adding yourself to the file (no review needed). The commit-queue restarts itself every 2 hours. After restart the commit-queue will correctly respect your committer rights.
Comment on attachment 188556 [details] Patch Clearing flags on attachment: 188556 Committed r143322: <http://trac.webkit.org/changeset/143322>
All reviewed patches have been landed. Closing bug.