[webkit-reviews] review requested: [Bug 15241] REGRESSION (r25124-r25140): Reproducible crash in WebCore::bidiNext inside NetNewsWire : [Attachment 16388] Addresses Darin's comments, fixes assertion.

[bugzilla-daemon at webkit.org]

Beth Dakin <bdakin at apple.com> has asked  for review:
Bug 15241: REGRESSION (r25124-r25140): Reproducible crash in WebCore::bidiNext
inside NetNewsWire
http://bugs.webkit.org/show_bug.cgi?id=15241

Attachment 16388: Addresses Darin's comments, fixes assertion.
http://bugs.webkit.org/attachment.cgi?id=16388&action=edit

------- Additional Comments from Beth Dakin <bdakin at apple.com>
This patch addresses all of Darin's comments from yesterday. I figured out that
the assertion was firing because the reduction caused a nested layout to
happen. That fact alone is kind of scary, but seems okay. The inner layout was
running the updateWidget(), and when the stack popped back to the outer layout,
the fact that updateWidget() had already been called meant that we needed
layout and the assertion fired. I discussed this with Mitz and Geoff, and we
decided that the best solution is to only call updateWidget from non-nested
calls to FrameView::layout(). (Or outer-most calls, depending on how you look
at it.) So that is what this patch does.