[Webkit-unassigned] [Bug 11672] REGRESSION (r17068): Repro crash due to painting without layout

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=11672





------- Comment #2 from mitz at webkit.org  2006-11-22 05:57 PDT -------
Created an attachment (id=11605)
 --> (http://bugs.webkit.org/attachment.cgi?id=11605&action=view)
Reduction (crashes when Test is clicked)

Here's the connection to r17068: RenderObject::setStyle() takes care of
reassigning positioned objects to their containing block when a container's
position property changes. It has logic to determine the current containing
block for it absolutely positioned children, which needs to be in sync with the
corresponding case in containingBlock(). r17068 changed containingBlock() and
container() by eliminating the !isRoot() check, but left it in setStyle():
                    while (cb && (cb->style()->position() == StaticPosition ||
(cb->isInline() && !cb->isReplaced())) && !cb->isRoot() && !cb->isRenderView())
{

Having said that, the two other issues (marking parents when you shouldn't and
-[WebCoreFrameBridge needsLayout] disregarding subtree layout) are still valid
in my opinion.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.