1. Assume we have 2 variable width regions, first small and the second larger in width 2. We flow floating content in these regions 3. After layout is done, we replace the floating content with inline content => the floats are cleared from their blocks (and associated data structures) 4. We layout inline content which does not fully fit in the first smaller region and needs to be moved to the next region 5. When we try to clear the remaining line layout in order to be moved to the next region, floats need to be cleared too 6. When trying to clear the floats in RenderBlock::removeFloatingObjectsBelow, we do not check if m_floatingObjects->set() is not empty before attempting to retrieve the last float from the collection (after step3, m_floatingObjects != 0 but m_floatingObjects.set() is not empty) 7. ASSERT
Created attachment 193462 [details] Patch
Comment on attachment 193462 [details] Patch r=me
Created attachment 193757 [details] Patch for landing
Comment on attachment 193757 [details] Patch for landing Clearing flags on attachment: 193757 Committed r146192: <http://trac.webkit.org/changeset/146192>
All reviewed patches have been landed. Closing bug.