Bug 114467

Summary: Do not reuse ExclusionShapeInsideInfo in a recursive region layout
Product: WebKit Reporter: CJ Gammon <gammon>
Component: Layout and RenderingAssignee: Bear Travis <betravis>
Status: RESOLVED FIXED    
Severity: Normal CC: betravis, commit-queue, esprehn+autocc, mihnea, WebkitBugTracker, zoltan
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 89256    
Attachments:
Description Flags
example scenario crashes tab in chrome
none
Initial Patch
none
Test Cleanup none

CJ Gammon
Reported 2013-04-11 15:02:08 PDT
Created attachment 197679 [details] example scenario crashes tab in chrome An element with -webkit-flow-from and -webkit-shape-inside applied to it with a floated element inside the content of the flow crashes the browser.
Attachments
example scenario crashes tab in chrome (945 bytes, application/zip)
2013-04-11 15:02 PDT, CJ Gammon
no flags
Initial Patch (9.87 KB, patch)
2013-04-15 14:52 PDT, Bear Travis
no flags
Test Cleanup (9.02 KB, patch)
2013-04-22 13:54 PDT, Bear Travis
no flags
Bear Travis
Comment 1 2013-04-15 13:49:07 PDT
Regions with shape-inside set will currently cause errors when the content contains elements that respect the shapes boundaries and contain inline content.
Bear Travis
Comment 2 2013-04-15 14:52:14 PDT
Created attachment 198189 [details] Initial Patch
Bear Travis
Comment 3 2013-04-22 13:54:04 PDT
Created attachment 199101 [details] Test Cleanup
Dave Hyatt
Comment 4 2013-04-22 15:10:03 PDT
Comment on attachment 199101 [details] Test Cleanup r=me
WebKit Commit Bot
Comment 5 2013-04-22 15:38:08 PDT
Comment on attachment 199101 [details] Test Cleanup Clearing flags on attachment: 199101 Committed r148920: <http://trac.webkit.org/changeset/148920>
WebKit Commit Bot
Comment 6 2013-04-22 15:38:10 PDT
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.