[Webkit-unassigned] [Bug 15241] REGRESSION (r25124-r25140): Reproducible crash in WebCore::bidiNext inside NetNewsWire

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=15241


bdakin at apple.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|webkit-                     |bdakin at apple.com
                   |unassigned at lists.webkit.org |
             Status|NEW                         |ASSIGNED
  Attachment #16374|                            |review?
               Flag|                            |




------- Comment #10 from bdakin at apple.com  2007-09-24 16:09 PDT -------
Created an attachment (id=16374)
 --> (http://bugs.webkit.org/attachment.cgi?id=16374&action=view)
Implement widget update queue on FrameView to updateWidget() when layout is
done

Here is a patch that fixes the original crash in NetNewsWire. It fixes the
reduction too, except that the reduction still ASSERTS on Debug builds in
FrameView::layout() with:

ASSERT(!root->needsLayout());

Interestingly, NetNewsWire does not ASSERT anywhere with this patch. So, the
problem with this patch is that there is no test. I am not sure how to test it
since this test asserts and involves turning off plug-ins, and I am not sure if
that is something that DumpRenderTree can currently handle.

All of the layout tests pass with this patch.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
You are the assignee for the bug, or are watching the assignee.