[Webkit-unassigned] [Bug 39143] REGRESSION (r59385) crash destroying inline renderers

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=39143





--- Comment #11 from Simon Fraser (smfr) <simon.fraser at apple.com>  2010-05-19 11:55:00 PST ---
(From update of attachment 56505)
> Index: WebCore/ChangeLog
> ===================================================================
> --- WebCore/ChangeLog	(revision 59776)
> +++ WebCore/ChangeLog	(working copy)
> @@ -1,3 +1,17 @@
> +2010-05-19  Enrica Casucci  <enrica at apple.com>
> +
> +        Reviewed by NOBODY (OOPS!).
> +
> +        REGRESSION (r59385) crash destroying inline renderers
> +        https://bugs.webkit.org/show_bug.cgi?id=39143
> +        <rdar://problem/8003662>
> +        
> +        Test: fast/inline-block/anonymous-block-crash.html
> +
> +        * rendering/RenderBlock.cpp:
> +        (WebCore::RenderBlock::layoutBlock): resetting the flag m_inlineChildren only for non anonymous blocks otherwise we incurr in
> +        a double deletion of the renderer that couses the crash.

It would be nice of the changelog explained why the crash occurs, and why not resetting the flag for anonymous blocks fixes it. i.e. dump some of your knowledge that you gained from your investigation into the changelog!

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.