[Webkit-unassigned] [Bug 18639] REGRESSION (3.1.1 - ToT): Crash in WebCore::RenderBlock:: determineStartPosition()

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=18639


webkit at mattlilek.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|0                           |1
           Keywords|                            |NeedsReduction
           Priority|P2                          |P1
            Summary|Crash in                    |REGRESSION (3.1.1 - ToT):
                   |WebCore::RenderBlock::layout|Crash in
                   |InlineChildren()            |WebCore::RenderBlock::
                   |                            |determineStartPosition()




------- Comment #2 from webkit at mattlilek.com  2008-04-20 14:25 PDT -------
Confirmed with r32282, this is a regression from Safari 3.1.1 (5525.18)

Top of debug stack trace:
Thread 0 Crashed:
0   com.apple.WebCore                   0x0224ce32
WebCore::RenderBlock::determineStartPosition(bool&,
WebCore::BidiResolver<WebCore::BidiIterator, WebCore::BidiRun>&,
WTF::Vector<WebCore::RenderBlock::FloatWithRect, 0ul>&, unsigned int&) + 154
(bidi.cpp:1148)
1   com.apple.WebCore                   0x0224df77
WebCore::RenderBlock::layoutInlineChildren(bool, int&, int&) + 1605
(bidi.cpp:861)
2   com.apple.WebCore                   0x02040a35
WebCore::RenderBlock::layoutBlock(bool) + 1299 (RenderBlock.cpp:580)
3   com.apple.WebCore                   0x0202fb58
WebCore::RenderBlock::layout() + 54 (RenderBlock.cpp:494)
4   com.apple.WebCore                   0x0224fa2d
WebCore::RenderObject::layoutIfNeeded() + 41 (RenderObject.h:500)


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.