143520 2015-04-08 06:17:55 -0700 ASSERTION FAILED: !beforeChild || is<RenderBlock>(*beforeChild->parent()) || is<RenderInline>(*beforeChild->parent()) in WebCore::RenderInline::addChildToContinuation 2015-12-29 12:57:27 -0800 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) Unspecified Unspecified RESOLVED WORKSFORME P2 Normal --- 116980 1 rhodovan.u-szeged webkit-unassigned cdumez mihnea zalan oldest_to_newest 1083592 0 250346 rhodovan.u-szeged 2015-04-08 06:17:55 -0700 Created attachment 250346 Test case Load this with debug WebKit: <!DOCTYPE html> <style> * { display: table-cell; -webkit-transition-duration: inherit; } ul { display: inline; } </style> <ul> <embed></embed> <dfn></dfn> <body ononline="" text=""></body> </ul> Backtrace: ASSERTION FAILED: !beforeChild || is<RenderBlock>(*beforeChild->parent()) || is<RenderInline>(*beforeChild->parent()) ../../Source/WebCore/rendering/RenderInline.cpp(570) : void WebCore::RenderInline::addChildToContinuation(WebCore::RenderObject*, WebCore::RenderObject*) Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fff8f53b700 (LWP 18348)] 0x00007fffed3987a4 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 321 *(int *)(uintptr_t)0xbbadbeef = 0; #0 0x00007fffed3987a4 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 #1 0x00007ffff3730092 in WebCore::RenderInline::addChildToContinuation (this=0x7fffd5feb8f0, newChild=0x7fffd5fd1b60, beforeChild=0x7fffd5fb24b0) at ../../Source/WebCore/rendering/RenderInline.cpp:570 #2 0x00007ffff372ef9b in WebCore::RenderInline::addChild (this=0x7fffd5feb8f0, newChild=0x7fffd5fd1b60, beforeChild=0x7fffd5fb24b0) at ../../Source/WebCore/rendering/RenderInline.cpp:269 #3 0x00007ffff3936a90 in WebCore::Style::RenderTreePosition::insert (this=0x7fffffffcc40, renderer=...) at ../../Source/WebCore/style/StyleResolveTree.cpp:224 #4 0x00007ffff393721a in WebCore::Style::createRendererIfNeeded (element=..., inheritedStyle=..., renderTreePosition=..., resolvedStyle=...) at ../../Source/WebCore/style/StyleResolveTree.cpp:336 #5 0x00007ffff39384e3 in WebCore::Style::attachRenderTree (current=..., inheritedStyle=..., renderTreePosition=..., resolvedStyle=...) at ../../Source/WebCore/style/StyleResolveTree.cpp:617 #6 0x00007ffff3938dd6 in WebCore::Style::resolveLocal (current=..., inheritedStyle=..., renderTreePosition=..., inheritedChange=WebCore::Style::Inherit) at ../../Source/WebCore/style/StyleResolveTree.cpp:758 #7 0x00007ffff393956d in WebCore::Style::resolveTree (current=..., inheritedStyle=..., renderTreePosition=..., change=WebCore::Style::Inherit) at ../../Source/WebCore/style/StyleResolveTree.cpp:920 #8 0x00007ffff39397dc in WebCore::Style::resolveTree (current=..., inheritedStyle=..., renderTreePosition=..., change=WebCore::Style::Inherit) at ../../Source/WebCore/style/StyleResolveTree.cpp:957 #9 0x00007ffff39397dc in WebCore::Style::resolveTree (current=..., inheritedStyle=..., renderTreePosition=..., change=WebCore::Style::Inherit) at ../../Source/WebCore/style/StyleResolveTree.cpp:957 #10 0x00007ffff39397dc in WebCore::Style::resolveTree (current=..., inheritedStyle=..., renderTreePosition=..., change=WebCore::Style::NoChange) at ../../Source/WebCore/style/StyleResolveTree.cpp:957 #11 0x00007ffff3939a52 in WebCore::Style::resolveTree (document=..., change=WebCore::Style::NoChange) at ../../Source/WebCore/style/StyleResolveTree.cpp:996 #12 0x00007ffff2d35cb2 in WebCore::Document::recalcStyle (this=0x7fffd40b0000, change=WebCore::Style::NoChange) at ../../Source/WebCore/dom/Document.cpp:1773 #13 0x00007ffff2d35f8b in WebCore::Document::updateStyleIfNeeded (this=0x7fffd40b0000) at ../../Source/WebCore/dom/Document.cpp:1823 #14 0x00007ffff2d41a9b in WebCore::Document::finishedParsing (this=0x7fffd40b0000) at ../../Source/WebCore/dom/Document.cpp:4755 #15 0x00007ffff30b5685 in WebCore::HTMLConstructionSite::finishedParsing (this=0x7fffd57e44a0) at ../../Source/WebCore/html/parser/HTMLConstructionSite.cpp:404 #16 0x00007ffff30f2060 in WebCore::HTMLTreeBuilder::finished (this=0x7fffd57e4480) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2940 #17 0x00007ffff30bdfee in WebCore::HTMLDocumentParser::end (this=0x7fffd4018680) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:402 #18 0x00007ffff30be0bc in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd (this=0x7fffd4018680) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:411 #19 0x00007ffff30bcd6c in WebCore::HTMLDocumentParser::prepareToStopParsing (this=0x7fffd4018680) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:132 #20 0x00007ffff30be0f3 in WebCore::HTMLDocumentParser::attemptToEnd (this=0x7fffd4018680) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:423 #21 0x00007ffff30be1a1 in WebCore::HTMLDocumentParser::finish (this=0x7fffd4018680) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:451 #22 0x00007ffff3227b5b in WebCore::DocumentWriter::end (this=0x7fffd401b660) at ../../Source/WebCore/loader/DocumentWriter.cpp:247 #23 0x00007ffff321320b in WebCore::DocumentLoader::finishedLoading (this=0x7fffd401b5c0, finishTime=0) at ../../Source/WebCore/loader/DocumentLoader.cpp:429 #24 0x00007ffff3212f74 in WebCore::DocumentLoader::notifyFinished (this=0x7fffd401b5c0, resource=0x7fffd4011000) at ../../Source/WebCore/loader/DocumentLoader.cpp:376 #25 0x00007ffff32c7348 in WebCore::CachedResource::checkNotify (this=0x7fffd4011000) at ../../Source/WebCore/loader/cache/CachedResource.cpp:291 #26 0x00007ffff32c7446 in WebCore::CachedResource::finishLoading (this=0x7fffd4011000) at ../../Source/WebCore/loader/cache/CachedResource.cpp:307 #27 0x00007ffff32c39c5 in WebCore::CachedRawResource::finishLoading (this=0x7fffd4011000, data=0x7fffd5fcd7b0) at ../../Source/WebCore/loader/cache/CachedRawResource.cpp:104 #28 0x00007ffff3276c45 in WebCore::SubresourceLoader::didFinishLoading (this=0x7fffd40119c0, finishTime=0) at ../../Source/WebCore/loader/SubresourceLoader.cpp:371 #29 0x00007ffff3272597 in WebCore::ResourceLoader::didFinishLoading (this=0x7fffd40119c0, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:562 #30 0x00007ffff3c1cd7d in WebCore::readCallback (asyncResult=0x8001a0, data=0x7fffd5fc4da0) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1318 #31 0x00007fffeae7f7d6 in async_ready_callback_wrapper (source_object=0x82f270, res=0x8001a0, user_data=user_data@entry=0x7fffd5fc4da0) at ginputstream.c:523 #32 0x00007fffeaea50d5 in g_task_return_now (task=0x8001a0) at gtask.c:1077 #33 0x00007fffeaea50f9 in complete_in_idle_cb (task=0x8001a0) at gtask.c:1086 #34 0x00007fffea15da2d in g_main_dispatch (context=0x478c20) at gmain.c:3064 #35 g_main_context_dispatch (context=context@entry=0x478c20) at gmain.c:3663 #36 0x00007fffea15dd98 in g_main_context_iterate (context=0x478c20, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3734 #37 0x00007fffea15e05a in g_main_loop_run (loop=0x4fe470) at gmain.c:3928 #38 0x00007ffff431a260 in WTF::RunLoop::run () at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:59 #39 0x00007ffff27f7192 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffd8f8) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61 #40 0x00007ffff27f6ff7 in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffd8f8) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:77 #41 0x00000000004008d1 in main (argc=2, argv=0x7fffffffd8f8) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:44 1151562 1 zalan 2015-12-29 12:57:27 -0800 I can't repro this anymore. Must have been fixed by one of the anonymous inline-table patches. 250346 2015-04-08 06:17:55 -0700 2015-04-08 06:17:55 -0700 Test case crash2.html text/html 219 rhodovan.u-szeged PCFET0NUWVBFIGh0bWw+CjxzdHlsZT4KKiB7CiAgICBkaXNwbGF5OiB0YWJsZS1jZWxsOwogICAg LXdlYmtpdC10cmFuc2l0aW9uLWR1cmF0aW9uOiBpbmhlcml0Owp9CnVsIHsKICAgIGRpc3BsYXk6 IGlubGluZTsKfQo8L3N0eWxlPgoKPHVsPgogICAgPGVtYmVkPjwvZW1iZWQ+CiAgICA8ZGZuPjwv ZGZuPgogICAgPGJvZHkgb25vbmxpbmU9IiIgdGV4dD0iIj48L2JvZHk+CjwvdWw+