[webkit-dev] Focus Crash Relating to MathML

[Alex Milowski]

On Mon, Oct 18, 2010 at 8:22 PM, Alex Milowski <alex at milowski.org> wrote:
> In cases where specialized render objects (typically with display
> inline-block) are used  (e.g. an operator), the assert fires:
>
> <a href='#'>
>  <math xmlns='http://www.w3.org/1998/Math/MathML'><mo>x</mo></math>
> </a>
>

The culprit in this particular case turns out to be a call to
destroyLeftoverChildren() during
the layout.  The RenderMathMLOperator class potentially re-stacks the glyphs and
that causes the children to be destroyed.  During that process, the
container ancestors
are marked as having a child needing layout.  At the end of the
ancestor's layout()
method, the MathML rendering objects have all sorted themselves out
and no longer
need layout.

The result is that the tree is inconsistent.  If the ancestors can
easily be marked
as having a child needing layout during the descendant's layout()
process, shouldn't
each ancestor check the consistency between if m_normalChildNeedsLayout and
their actual children before leaving layout()?


-- 
--Alex Milowski
"The excellence of grammar as a guide is proportional to the paucity of the
inflexions, i.e. to the degree of analysis effected by the language
considered."

Bertrand Russell in a footnote of Principles of Mathematics