122027 2013-09-27 12:05:31 -0700 ASSERTION FAILED: foundContainer in RenderGeometryMap::mapToContainer(WebCore::TransformState &, const WebCore::RenderLayerModelObject *) const 2018-12-03 14:36:12 -0800 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) Unspecified Unspecified ASSIGNED InRadar P2 Normal --- 1 zalan zalan cadubentzen jeffrey+webkit rhodovan.u-szeged simon.fraser webkit-bug-importer oldest_to_newest 934033 0 zalan 2013-09-27 12:05:31 -0700 SSIA 934034 1 212830 zalan 2013-09-27 12:06:29 -0700 Created attachment 212830 test reduction 934035 2 zalan 2013-09-27 12:07:04 -0700 <rdar://problem/15082483> 934046 3 zalan 2013-09-27 12:31:32 -0700 This happens when the layout container tree != painting container tree. With CSS filters (blur in this case), when a child element is (absolute)positioned, its parent in layout terms might differ from its parent in painting terms. The geometry map is initiated with layout containers, but in RenderLayer::updateLayerPositionsAfterScroll(), we pass the repaint container to the mapping function, which in turn fails to transform the coordinates as repaint container != layout container ->assert. -see computeRepaintRects(renderer().containerForRepaint(), geometryMap); 937644 4 jeffrey+webkit 2013-10-08 13:20:58 -0700 This is likely the same bug as https://bugs.webkit.org/show_bug.cgi?id=117981 950393 5 zalan 2013-11-13 14:56:01 -0800 *** Bug 117981 has been marked as a duplicate of this bug. *** 950509 6 zalan 2013-11-13 20:40:08 -0800 (In reply to comment #3) > This happens when the layout container tree != painting container tree. > With CSS filters (blur in this case), when a child element is (absolute)positioned, its parent in layout terms might differ from its parent in painting terms. The geometry map is initiated with layout containers, but in RenderLayer::updateLayerPositionsAfterScroll(), we pass the repaint container to the mapping function, which in turn fails to transform the coordinates as repaint container != layout container ->assert. -see computeRepaintRects(renderer().containerForRepaint(), geometryMap); Let me rephrase it. The container tree for the absolute positioned object is not the same as the painting tree unless the parent has transform or it is positioned too. In this case, the parent has CSS filter only and while it requires a dedicated render layer, when it comes to figuring out the containing block, it is skipped. 1484520 7 cadubentzen 2018-12-03 14:36:12 -0800 I just hit this assertion in WPE running Youtube TV. 212830 2013-09-27 12:06:29 -0700 2013-09-27 12:06:29 -0700 test reduction 0014-reduced.html text/html 159 zalan PCFET0NUWVBFIGh0bWw+PGh0bWw+Cjxib2R5Pgo8ZGl2IHN0eWxlPSItd2Via2l0LWZpbHRlcjog Ymx1cigpOyI+PGRpdiBzdHlsZT0icG9zaXRpb246IGFic29sdXRlOyI+PG1hcnF1ZWU+PGRpdj5h PC9kaXY+PC9tYXJxdWVlPjwvZGl2PjwvZGl2Pgo8L2JvZHk+CjwvaHRtbD4K