[Webkit-unassigned] [Bug 44804] Crashes in RenderMathMLRoot::layout() and RenderMathMLRoot::paint()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=44804





--- Comment #8 from Daniel Bates <dbates at webkit.org>  2010-08-29 23:30:30 PST ---
Created an attachment (id=65882)
 --> (https://bugs.webkit.org/attachment.cgi?id=65882)
Reduced Test Case 2

I was able to reduce the second test case <https://bugs.webkit.org/attachment.cgi?id=65784> to:

<math>
    <mroot></mroot>
</math>

Without the patch, both this and <https://bugs.webkit.org/attachment.cgi?id=65784> crash at:

int maxHeight = toRenderBoxModelObject(lastChild())->offsetHeight();

because lastChild() returns a null pointer.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.