[Webkit-unassigned] [Bug 45095] New: absolutely positioned list in inline element crashes

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=45095

           Summary: absolutely positioned list in inline element crashes
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: hamaji at chromium.org
                CC: mitz at webkit.org


WebKit crashes for

<span>
<li>
<li style="position: absolute; list-style-type: upper-roman;">

The render tree for this HTML is

layer at (0,0) size 800x600
  RenderView at (0,0) size 800x600
layer at (0,0) size 800x600
  RenderBlock {HTML} at (0,0) size 800x600
    RenderBody {BODY} at (8,8) size 784x584
      RenderBlock (anonymous) at (0,0) size 784x0
        RenderInline {SPAN} at (0,0) size 0x0
          RenderText {#text} at (0,0) size 0x0
      RenderBlock (anonymous) at (0,0) size 784x18
        RenderListItem {LI} at (0,0) size 784x18
          RenderListMarker at (-1,0) size 7x18: bullet
      RenderBlock (anonymous) at (0,18) size 784x0
        RenderInline {SPAN} at (0,0) size 0x0
layer at (8,26) size 18x18
  RenderListItem {LI} at (8,26) size 18x18
    RenderListMarker at (0,0) size 18x18: "II"

This crash happens because enclosingList in RenderListItem.cpp returns different nodes for the two <li> elements. Using only block element in enclosingList would fix this issue, I'm not 100% sure if this is the best fix though. A patch will come soon later.

(CCing mitz as he seemed to touch this code recently in http://trac.webkit.org/changeset/53868)

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.