Bug 68550 - REGRESSION: Crash in RenderBlock::removeFloatingObjectsBelow()
Summary: REGRESSION: Crash in RenderBlock::removeFloatingObjectsBelow()
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P1 Normal
Assignee: mitz
URL:
Keywords: InRadar, Regression
Depends on:
Blocks:
 
Reported: 2011-09-21 11:23 PDT by mitz
Modified: 2011-09-21 11:45 PDT (History)
0 users

See Also:

Attachments
Test case (will crash) (652 bytes, text/html)
2011-09-21 11:23 PDT, mitz 		no flags Details
Check if the floating object set has become empty (3.76 KB, patch)
2011-09-21 11:35 PDT, mitz 		darin: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description mitz 2011-09-21 11:23:08 PDT 
Created attachment 108189 [details]
Test case (will crash)

<rdar://problem/9768483>

The attached test case causes WebKit to crash in RenderBlock::removeFloatingObjectsBelow(). Patch forthcoming.
Comment 1 mitz 2011-09-21 11:35:42 PDT 
Created attachment 108195 [details]
Check if the floating object set has become empty
Comment 2 mitz 2011-09-21 11:45:48 PDT 
Fixed in <http://trac.webkit.org/r95654>.