Bug 18639 - REGRESSION (3.1.1 - ToT): Crash in WebCore::RenderBlock:: determineStartPosition()
Summary: REGRESSION (3.1.1 - ToT): Crash in WebCore::RenderBlock:: determineStartPosit...
Status: RESOLVED DUPLICATE of bug 18722
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.5
: P1 Major
Assignee: Nobody
URL: http://www.farecompare.com/fare-searc...
Keywords: NeedsReduction
Depends on:
Blocks:
 
Reported: 2008-04-20 14:07 PDT by Dave Marquard
Modified: 2008-05-29 15:02 PDT (History)
0 users

See Also:

Attachments
crash log from r32268 (27.73 KB, text/plain)
2008-04-20 14:08 PDT, Dave Marquard 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Dave Marquard 2008-04-20 14:07:01 PDT 
I'm seeing a reproducible crash in WebCore::RenderBlock::layoutInlineChildren() in r32268. To reproduce the crash, go to http://www.farecompare.com/fare-search/year.html?type=homepage2&departure=AUS&destination=CLE&t=r&s=r#Select_Depart_Day and click the "September 2008" box.
Comment 1 Dave Marquard 2008-04-20 14:08:19 PDT 
Created attachment 20707 [details]
crash log from r32268

crash log from r32268 attached.
Comment 2 Matt Lilek 2008-04-20 14:25:11 PDT 
Confirmed with r32282, this is a regression from Safari 3.1.1 (5525.18)

Top of debug stack trace:
Thread 0 Crashed:
0   com.apple.WebCore             	0x0224ce32 WebCore::RenderBlock::determineStartPosition(bool&, WebCore::BidiResolver<WebCore::BidiIterator, WebCore::BidiRun>&, WTF::Vector<WebCore::RenderBlock::FloatWithRect, 0ul>&, unsigned int&) + 154 (bidi.cpp:1148)
1   com.apple.WebCore             	0x0224df77 WebCore::RenderBlock::layoutInlineChildren(bool, int&, int&) + 1605 (bidi.cpp:861)
2   com.apple.WebCore             	0x02040a35 WebCore::RenderBlock::layoutBlock(bool) + 1299 (RenderBlock.cpp:580)
3   com.apple.WebCore             	0x0202fb58 WebCore::RenderBlock::layout() + 54 (RenderBlock.cpp:494)
4   com.apple.WebCore             	0x0224fa2d WebCore::RenderObject::layoutIfNeeded() + 41 (RenderObject.h:500)
Comment 3 Dave Marquard 2008-05-29 13:14:17 PDT 
This no longer causes a crash with the original reproduction scenario. Resolving this as WORKSFORME since the underlying defect was most likely fixed.
Comment 4 mitz 2008-05-29 15:02:25 PDT 
Reopening to close as duplicate.
Comment 5 mitz 2008-05-29 15:02:44 PDT 

*** This bug has been marked as a duplicate of 18722 ***