[Webkit-unassigned] [Bug 44804] Crashes in RenderMathMLRoot::layout() and RenderMathMLRoot::paint()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=44804





--- Comment #7 from Daniel Bates <dbates at webkit.org>  2010-08-29 23:25:55 PST ---
Created an attachment (id=65881)
 --> (https://bugs.webkit.org/attachment.cgi?id=65881)
Reduced Test Case 1

I was able to reduce the first test case <https://bugs.webkit.org/attachment.cgi?id=65783> to:

<math>
    <mroot><mi></mi></mroot>
</math>

Without the patch, both this and <https://bugs.webkit.org/attachment.cgi?id=65783> crash at:

int indexShift = indexBox->offsetWidth() + topStartShift;

because indexBox is null.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.