[Webkit-unassigned] [Bug 15241] REGRESSION (r25124-r25140): Reproducible crash in WebCore::bidiNext inside NetNewsWire

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed Sep 19 18:26:52 PDT 2007


mitz at webkit.org changed:

           What    |Removed                     |Added
                 CC|                            |andersca at apple.com
          Component|Text                        |Layout and Rendering

------- Comment #9 from mitz at webkit.org  2007-09-19 18:26 PDT -------
r25128 made it possible for RenderPartObject::updateWidget() to be called
during layout. That function can call
HTMLObjectElement::renderFallbackContent(), which does a detach/attach. That's
a Very Bad Thing to do during layout.

Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

More information about the webkit-unassigned mailing list