[webkit-reviews] review requested: [Bug 15241] REGRESSION (r25124-r25140): Reproducible crash in WebCore::bidiNext inside NetNewsWire : [Attachment 16374] Implement widget update queue on FrameView to updateWidget() when layout is done

[bugzilla-daemon at webkit.org]

Beth Dakin <bdakin at apple.com> has asked  for review:
Bug 15241: REGRESSION (r25124-r25140): Reproducible crash in WebCore::bidiNext
inside NetNewsWire
http://bugs.webkit.org/show_bug.cgi?id=15241

Attachment 16374: Implement widget update queue on FrameView to updateWidget()
when layout is done
http://bugs.webkit.org/attachment.cgi?id=16374&action=edit

------- Additional Comments from Beth Dakin <bdakin at apple.com>
Here is a patch that fixes the original crash in NetNewsWire. It fixes the
reduction too, except that the reduction still ASSERTS on Debug builds in
FrameView::layout() with:

ASSERT(!root->needsLayout());

Interestingly, NetNewsWire does not ASSERT anywhere with this patch. So, the
problem with this patch is that there is no test. I am not sure how to test it
since this test asserts and involves turning off plug-ins, and I am not sure if
that is something that DumpRenderTree can currently handle.

All of the layout tests pass with this patch.