[Webkit-unassigned] [Bug 15241] REGRESSION (r25124-r25140): Reproducible crash in WebCore::bidiNext inside NetNewsWire

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=15241


mitz at webkit.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |andersca at apple.com
          Component|Text                        |Layout and Rendering




------- Comment #9 from mitz at webkit.org  2007-09-19 18:26 PDT -------
r25128 made it possible for RenderPartObject::updateWidget() to be called
during layout. That function can call
HTMLObjectElement::renderFallbackContent(), which does a detach/attach. That's
a Very Bad Thing to do during layout.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.