[Webkit-unassigned] [Bug 42894] RenderLayer crashes on page with MathML

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=42894





--- Comment #4 from Alex Milowski <alex at milowski.com>  2010-07-23 08:22:37 PST ---
(In reply to comment #1)
> (From update of attachment 62423 [details])
> The patch seems OK, but why wasn't this needed before? I mean, maybe the code is correct assuming that we will have an actualRenderer and the bug is elsewhere. Would be nice if Hyatt could have a look.

It is unclear why this is happening except that the referenced page is much more complex than our tests.  This must be coming from the combination of the styles used on the page in conjunction with the MathML rendering.  

The backtrace has this happening at the time that setStyle() is called the newly created RenderMathMLMath instance in the createRenderer() call on the MathMLMathElement.   When the setStyle() is called, it causes a style difference to be calculated and that is when things go wrong.

That code looks like:

RenderObject* MathMLMathElement::createRenderer(RenderArena* arena, RenderStyle* style)
{
    RenderMathMLMath* renderer = new (arena) RenderMathMLMath(this);
    renderer->setStyle(style);
    return renderer;
}

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.