Bug 68550 - REGRESSION: Crash in RenderBlock::removeFloatingObjectsBelow()
Summary: REGRESSION: Crash in RenderBlock::removeFloatingObjectsBelow()
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P1 Normal
Assignee: mitz
Keywords: InRadar, Regression
Depends on:
Reported: 2011-09-21 11:23 PDT by mitz
Modified: 2011-09-21 11:45 PDT (History)
0 users

See Also:

Test case (will crash) (652 bytes, text/html)
2011-09-21 11:23 PDT, mitz
no flags Details
Check if the floating object set has become empty (3.76 KB, patch)
2011-09-21 11:35 PDT, mitz
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description mitz 2011-09-21 11:23:08 PDT
Created attachment 108189 [details]
Test case (will crash)


The attached test case causes WebKit to crash in RenderBlock::removeFloatingObjectsBelow(). Patch forthcoming.
Comment 1 mitz 2011-09-21 11:35:42 PDT
Created attachment 108195 [details]
Check if the floating object set has become empty
Comment 2 mitz 2011-09-21 11:45:48 PDT
Fixed in <http://trac.webkit.org/r95654>.