[Webkit-unassigned] [Bug 12886] Crash with Scriptalicious javascript library

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=12886





------- Comment #2 from mitz at webkit.org  2007-02-25 11:15 PDT -------
Created an attachment (id=13370)
 --> (http://bugs.webkit.org/attachment.cgi?id=13370&action=view)
Slightly more general reduction (ditto)

The "foo" div doesn't get marked for layout. The check in layoutBlockChildren()
is
        // If an element might be affected by the presence of floats, then
always mark it for
        // layout.
which doesn't cover an object being affected by floats no longer intruding into
it.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.