[webkit-reviews] review denied: [Bug 48255] Stack overflow when there are too many sibling inline boxes : [Attachment 72703] updated with much smaller test case

[bugzilla-daemon at webkit.org]

Andreas Kling <kling at webkit.org> has denied Yong Li
<yong.li.webkit at gmail.com>'s request for review:
Bug 48255: Stack overflow when there are too many sibling inline boxes
https://bugs.webkit.org/show_bug.cgi?id=48255

Attachment 72703: updated with much smaller test case
https://bugs.webkit.org/attachment.cgi?id=72703&action=review

------- Additional Comments from Andreas Kling <kling at webkit.org>
View in context: https://bugs.webkit.org/attachment.cgi?id=72703&action=review

> WebCore/rendering/InlineBox.h:165
> -    virtual void setConstructed()
> -    {
> -	   m_constructed = true;
> -	   if (m_next)
> -	       m_next->setConstructed();
> -    }
> +    virtual void setConstructed() { m_constructed = true; }

This looks like a behavior change to me, InlineBox::setConstructed() will no
longer affect sibling boxes.
Is this correct (and safe)?

> WebCore/rendering/InlineBox.h:284
> +    InlineBox* next() { return m_next; }

This method should be const.