[Webkit-unassigned] [Bug 44207] New: Empty mfrac and empty munderover cause crashes

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=44207

           Summary: Empty mfrac and empty munderover cause crashes
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Mac OS X 10.5
            Status: NEW
          Keywords: InRadar
          Severity: Normal
          Priority: P2
         Component: MathML
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: bdakin at apple.com


I have test cases and a patch. Will post shortly.

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000
Crashed Thread:  0

Crashed Thread:
0   com.apple.WebCore                 0x000000010153bdd0 WebCore::RenderMathMLUnderOver::baselinePosition(bool, bool) const + 192
1   com.apple.WebCore                 0x0000000101005ccb WebCore::InlineFlowBox::computeLogicalBoxHeights(int&, int&, int&, int&, bool, WTF::HashMap<WebCore::InlineTextBox const*, std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow>, WTF::PtrHash<WebCore::InlineTextBox const*>, WTF::HashTraits<WebCore::InlineTextBox const*>, WTF::HashTraits<std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow> > >&) + 939
2   com.apple.WebCore                 0x00000001015c7630 WebCore::RootInlineBox::verticallyAlignBoxes(int, WTF::HashMap<WebCore::InlineTextBox const*, std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow>, WTF::PtrHash<WebCore::InlineTextBox const*>, WTF::HashTraits<WebCore::InlineTextBox const*>, WTF::HashTraits<std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow> > >&) + 176


<rdar://problem/8325160> filefuzz: crash at WebCore::RenderMathMLUnderOver::baselinePosition(bool, bool) const+192

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.