108452 2013-01-31 03:10:48 -0800 ASSERT(clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRectsType]) in RenderLayer 2013-01-31 09:09:48 -0800 1 1 1 Unclassified WebKit CSS 528+ (Nightly build) Unspecified Unspecified RESOLVED DUPLICATE 108257 P2 Normal --- 1 rhodovan.u-szeged webkit-unassigned simon.fraser oldest_to_newest 821314 0 rhodovan.u-szeged 2013-01-31 03:10:48 -0800 I've got the following assert during HTML fuzzing: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff44927b8 in WebCore::RenderLayer::updateClipRects (this=0x7c70d8, clipRectsContext=...) at /home/reni/WebKit-git/Source/WebCore/rendering/RenderLayer.cpp:4521 4521 ASSERT(clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRectsType]); The test: <html> <body style="-webkit-column-count: 2; -webkit-column-gap: 0"> <div style="overflow: scroll"> <div style="position: absolute;"></div> <div style="-webkit-box-reflect: below 2px"></div> </div> </body> </html> 821571 1 simon.fraser 2013-01-31 09:09:48 -0800 *** This bug has been marked as a duplicate of bug 108257 ***