[Webkit-unassigned] [Bug 10213] REGRESSION: Crash in WebCore::RenderLayer::isTransparent involving <iframe> and <select>

[bugzilla-daemon at opendarwin.org]

http://bugzilla.opendarwin.org/show_bug.cgi?id=10213





------- Comment #3 from darin at apple.com  2006-08-03 20:29 PDT -------
This test case involves an <iframe> inside an <option>. In an HTML page, the
parser would not allow that sort of nesting. But since this is XHTML, we allow
anything to go anywhere.

Because the <iframe> is inside an <option>, it ends up without a renderer. The
code that crashes is code in RenderView::paintBoxDecorations that assumes that
the owner element of a frame is going to have a renderer.

A nil check would suffice to prevent the crash.


-- 
Configure bugmail: http://bugzilla.opendarwin.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.