[Webkit-unassigned] [Bug 26342] Absolutely positioned HTML element within foreignObject of absolutely positioned SVG crashes Safari

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=26342





--- Comment #8 from Simon Fraser (smfr) <simon.fraser at apple.com>  2009-09-15 10:17:24 PDT ---
Crash point:

#0  0x00000001014a5ef3 in WebCore::RenderBlock::insertPositionedObject
(this=0x0, o=0x11c241328) at
/Volumes/InternalData/Development/webkit/OpenSource/WebCore/rendering/RenderBlock.cpp:2217
#1  0x00000001014c2368 in WebCore::RenderBlock::layoutInlineChildren
(this=0x11c240c38, relayoutChildren=true, repaintTop=@0x7fff5fbfca1c,
repaintBottom=@0x7fff5fbfca18) at
/Volumes/InternalData/Development/webkit/OpenSource/WebCore/rendering/RenderBlockLineLayout.cpp:858
#2  0x00000001014a8d69 in WebCore::RenderBlock::layoutBlock (this=0x11c240c38,
relayoutChildren=true) at
/Volumes/InternalData/Development/webkit/OpenSource/WebCore/rendering/RenderBlock.cpp:712
#3  0x00000001014a230f in WebCore::RenderBlock::layout (this=0x11c240c38) at
/Volumes/InternalData/Development/webkit/OpenSource/WebCore/rendering/RenderBlock.cpp:638
#4  0x00000001014a7f4f in WebCore::RenderBlock::layoutBlockChild
(this=0x11c240698, child=0x11c240c38, marginInfo=@0x7fff5fbfcc00,
previousFloatBottom=@0x7fff5fbfcc84, maxFloatBottom=@0x7fff5fbfcda4) at
/Volumes/InternalData/Development/webkit/OpenSource/WebCore/rendering/RenderBlock.cpp:1327
#5  0x00000001014a88ae in WebCore::RenderBlock::layoutBlockChildren
(this=0x11c240698, relayoutChildren=true, maxFloatBottom=@0x7fff5fbfcda4) at
/Volumes/InternalData/Development/webkit/OpenSource/WebCore/rendering/RenderBlock.cpp:1270
#6  0x00000001014a8d82 in WebCore::RenderBlock::layoutBlock (this=0x11c240698,
relayoutChildren=true) at
/Volumes/InternalData/Development/webkit/OpenSource/WebCore/rendering/RenderBlock.cpp:714
#7  0x00000001014a230f in WebCore::RenderBlock::layout (this=0x11c240698) at
/Volumes/InternalData/Development/webkit/OpenSource/WebCore/rendering/RenderBlock.cpp:638
#8  0x00000001014ed65d in WebCore::RenderForeignObject::layout
(this=0x11c240698) at
/Volumes/InternalData/Development/webkit/OpenSource/WebCore/rendering/RenderForeignObject.cpp:103
#9  0x00000001014c406f in WebCore::RenderObject::layoutIfNeeded
(this=0x11c240698) at RenderObject.h:487
#10 0x0000000101552034 in WebCore::RenderSVGRoot::layout (this=0x11c23e4f8) at
/Volumes/InternalData/Development/webkit/OpenSource/WebCore/rendering/RenderSVGRoot.cpp:102
#11 0x00000001014c406f in WebCore::RenderObject::layoutIfNeeded
(this=0x11c23e4f8) at RenderObject.h:487
#12 0x00000001014993c0 in WebCore::RenderBlock::layoutPositionedObjects
(this=0x10612c088, relayoutChildren=true) at
/Volumes/InternalData/Development/webkit/OpenSource/WebCore/rendering/

o->containingBlock() is null at:

                    o->containingBlock()->insertPositionedObject(box);

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.