Bug 18722 – Webkit Nightly Build crashes when visiting i has a hotdog.

• Status: RESOLVED
• Resolution: FIXED
• Component: Layout and Rendering

[Mattias Stahre]

When visiting ihasahotdog.com there is an instant crash of the webbrowser when using nightly builds, however, the "stable" Safari 3.1 do not crash when visiting this site.

[Mark Rowe (bdash)]

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x00000000000001d4
Crashed Thread:  0

Thread 0 Crashed:
0   com.apple.WebCore             	0x0107bf6b WebCore::RenderBlock::determineStartPosition(bool&, WebCore::BidiResolver<WebCore::BidiIterator, WebCore::BidiRun>&, WTF::Vector<WebCore::RenderBlock::FloatWithRect, 0ul>&, unsigned int&) + 283
1   com.apple.WebCore             	0x0107f7af WebCore::RenderBlock::layoutInlineChildren(bool, int&, int&) + 1039
2   com.apple.WebCore             	0x00eb3e8c WebCore::RenderBlock::layoutBlock(bool) + 716
3   com.apple.WebCore             	0x00ea5f28 WebCore::RenderBlock::layout() + 40
4   com.apple.WebCore             	0x00eb023f WebCore::RenderBlock::layoutBlockChildren(bool, int&) + 1935
5   com.apple.WebCore             	0x00eb43b9 WebCore::RenderBlock::layoutBlock(bool) + 2041
6   com.apple.WebCore             	0x00ea5f28 WebCore::RenderBlock::layout() + 40
7   com.apple.WebCore             	0x00eb023f WebCore::RenderBlock::layoutBlockChildren(bool, int&) + 1935
8   com.apple.WebCore             	0x00eb43b9 WebCore::RenderBlock::layoutBlock(bool) + 2041
9   com.apple.WebCore             	0x00ea5f28 WebCore::RenderBlock::layout() + 40
10  com.apple.WebCore             	0x00eb023f WebCore::RenderBlock::layoutBlockChildren(bool, int&) + 1935
11  com.apple.WebCore             	0x00eb43b9 WebCore::RenderBlock::layoutBlock(bool) + 2041
12  com.apple.WebCore             	0x00ea5f28 WebCore::RenderBlock::layout() + 40
13  com.apple.WebCore             	0x00ea7ca4 WebCore::RenderBlock::insertFloatingObject(WebCore::RenderObject*) + 116
14  com.apple.WebCore             	0x00eaf637 WebCore::RenderBlock::handleFloatingChild(WebCore::RenderObject*, WebCore::RenderBlock::MarginInfo const&, bool&) + 39
15  com.apple.WebCore             	0x00eaf6ca WebCore::RenderBlock::handleSpecialChild(WebCore::RenderObject*, WebCore::RenderBlock::MarginInfo const&, WebCore::RenderBlock::CompactInfo&, bool&) + 106
16  com.apple.WebCore             	0x00eafc11 WebCore::RenderBlock::layoutBlockChildren(bool, int&) + 353
17  com.apple.WebCore             	0x00eb43b9 WebCore::RenderBlock::layoutBlock(bool) + 2041

[Mark Rowe (bdash)]

<rdar://problem/5888360>

[Mark Rowe (bdash)]

Crash log was from r32516.

Created attachment 20806 [details]
Patch with regression test

[Dave Hyatt]

Comment on attachment 20806 [details]
Patch with regression test

r=me, but I'm taking off points for you not saying "I can haz review?" when you posted the patch.

Fixed in <http://trac.webkit.org/projects/webkit/changeset/32532>.

*** Bug 18639 has been marked as a duplicate of this bug. ***