RESOLVED FIXED 114467
Do not reuse ExclusionShapeInsideInfo in a recursive region layout 
https://bugs.webkit.org/show_bug.cgi?id=114467
Summary Do not reuse ExclusionShapeInsideInfo in a recursive region layout
CJ Gammon
Reported 2013-04-11 15:02:08 PDT
Created attachment 197679 [details] example scenario crashes tab in chrome An element with -webkit-flow-from and -webkit-shape-inside applied to it with a floated element inside the content of the flow crashes the browser.
Attachments
example scenario crashes tab in chrome (945 bytes, application/zip)
2013-04-11 15:02 PDT, CJ Gammon 		no flags
Details
Initial Patch (9.87 KB, patch)
2013-04-15 14:52 PDT, Bear Travis 		no flags
DetailsFormatted DiffDiff
Test Cleanup (9.02 KB, patch)
2013-04-22 13:54 PDT, Bear Travis 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Bear Travis
Comment 1 2013-04-15 13:49:07 PDT
Regions with shape-inside set will currently cause errors when the content contains elements that respect the shapes boundaries and contain inline content.
Bear Travis
Comment 2 2013-04-15 14:52:14 PDT
Created attachment 198189 [details] Initial Patch
Bear Travis
Comment 3 2013-04-22 13:54:04 PDT
Created attachment 199101 [details] Test Cleanup
Dave Hyatt
Comment 4 2013-04-22 15:10:03 PDT
Comment on attachment 199101 [details] Test Cleanup r=me
WebKit Commit Bot
Comment 5 2013-04-22 15:38:08 PDT
Comment on attachment 199101 [details] Test Cleanup Clearing flags on attachment: 199101 Committed r148920: <http://trac.webkit.org/changeset/148920>
WebKit Commit Bot
Comment 6 2013-04-22 15:38:10 PDT
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.