155702 2016-03-20 11:04:36 -0700 ASSERTION FAILED: hasOverflowingCell == this->hasOverflowingCell() in WebCore::RenderTableSection::computeOverflowFromCells 2016-08-23 14:49:07 -0700 1 1 1 Unclassified WebKit Layout and Rendering WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 116980 1 rhodovan.u-szeged zalan bfulgham commit-queue esprehn+autocc glenn kling kondapallykalyan mitz simon.fraser webkit-bug-importer zalan oldest_to_newest 1176599 0 274545 rhodovan.u-szeged 2016-03-20 11:04:36 -0700 Created attachment 274545 Test case Load the attached test with minibrowser: <script> window.onload = function() { window.scrollTo(0,document.body.scrollHeight); document.designMode = 'on'; var parent = document.getElementById('foo'); parent.removeChild(parent.childNodes[0]); } </script> <style> * { margin-top: -47%; text-emphasis-position: under right; position: relative; display: inline-table; } ins { position: absolute; text-emphasis-style: filled; } </style> <li></li> <table> <th> <ins><h3><pre><a>a<pre><ins><details></details></ins></pre></a></pre></h3></ins> </th> </table> OS: Ubuntu 15.10, x86_64 (also validated on Mac OS X 10.11.1 (x86_64), x86_64) Checked build: debug EFL (and MAC) Checked version: d5bbb4a Backtrace: ASSERTION FAILED: hasOverflowingCell == this->hasOverflowingCell() ../../Source/WebCore/rendering/RenderTableSection.cpp(712) : void WebCore::RenderTableSection::computeOverflowFromCells(unsigned int, unsigned int) 1 0x7fa4948e83a6 WTFCrash 2 0x7fa493896f75 WebCore::RenderTableSection::computeOverflowFromCells(unsigned int, unsigned int) 3 0x7fa493896d1e WebCore::RenderTableSection::computeOverflowFromCells() 4 0x7fa49387b031 WebCore::RenderTable::simplifiedNormalFlowLayout() 5 0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout() 6 0x7fa49387b0d0 WebCore::RenderTable::layout() 7 0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded() 8 0x7fa4936b10dc WebCore::RenderBlock::simplifiedNormalFlowLayout() 9 0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout() 10 0x7fa4936dead5 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 11 0x7fa493889680 WebCore::RenderTableCell::layout() 12 0x7fa493892e46 WebCore::RenderTableRow::layout() 13 0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded() 14 0x7fa493895569 WebCore::RenderTableSection::layout() 15 0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded() 16 0x7fa49387b537 WebCore::RenderTable::layout() 17 0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded() 18 0x7fa4937053fe WebCore::RenderBlockFlow::layoutLineBoxes(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 19 0x7fa4936dfa97 WebCore::RenderBlockFlow::layoutInlineChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 20 0x7fa4936dee10 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 21 0x7fa493889680 WebCore::RenderTableCell::layout() 22 0x7fa493892e46 WebCore::RenderTableRow::layout() 23 0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded() 24 0x7fa493895569 WebCore::RenderTableSection::layout() 25 0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded() 26 0x7fa49387b025 WebCore::RenderTable::simplifiedNormalFlowLayout() 27 0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout() 28 0x7fa49387b0d0 WebCore::RenderTable::layout() 29 0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded() 30 0x7fa4936b10dc WebCore::RenderBlock::simplifiedNormalFlowLayout() 31 0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout() 1217921 1 bfulgham 2016-08-05 09:47:57 -0700 This reproduces in r204037. 1217923 2 webkit-bug-importer 2016-08-05 09:48:10 -0700 <rdar://problem/27720731> 1222012 3 286632 zalan 2016-08-22 15:40:35 -0700 Created attachment 286632 Test reduction 1222394 4 286767 zalan 2016-08-23 13:50:39 -0700 Created attachment 286767 Patch 1222414 5 286767 hyatt 2016-08-23 14:23:24 -0700 Comment on attachment 286767 Patch r=me 1222433 6 286767 commit-queue 2016-08-23 14:49:03 -0700 Comment on attachment 286767 Patch Clearing flags on attachment: 286767 Committed r204860: <http://trac.webkit.org/changeset/204860> 1222434 7 commit-queue 2016-08-23 14:49:07 -0700 All reviewed patches have been landed. Closing bug. 274545 2016-03-20 11:04:36 -0700 2016-08-22 15:40:35 -0700 Test case test.html text/html 524 rhodovan.u-szeged PHNjcmlwdD4Kd2luZG93Lm9ubG9hZCA9IGZ1bmN0aW9uKCkgewoJd2luZG93LnNjcm9sbFRvKDAs ZG9jdW1lbnQuYm9keS5zY3JvbGxIZWlnaHQpOwoJZG9jdW1lbnQuZGVzaWduTW9kZSA9ICdvbic7 Cgl2YXIgcGFyZW50ID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2ZvbycpOwoJcGFyZW50LnJl bW92ZUNoaWxkKHBhcmVudC5jaGlsZE5vZGVzWzBdKTsKCn0KPC9zY3JpcHQ+CjxzdHlsZT4KKiB7 CgltYXJnaW4tdG9wOiAtNDclOwoJdGV4dC1lbXBoYXNpcy1wb3NpdGlvbjogdW5kZXIgcmlnaHQ7 Cglwb3NpdGlvbjogcmVsYXRpdmU7CglkaXNwbGF5OiBpbmxpbmUtdGFibGU7Cn0KaW5zIHsKCXBv c2l0aW9uOiBhYnNvbHV0ZTsKCXRleHQtZW1waGFzaXMtc3R5bGU6IGZpbGxlZDsKfQo8L3N0eWxl Pgo8bGk+PC9saT4KPHRhYmxlPgoJPHRoPgoJCTxpbnM+PGgzPjxwcmU+PGE+YTxwcmU+PGlucz48 ZGV0YWlscz48L2RldGFpbHM+PC9pbnM+PC9wcmU+PC9hPjwvcHJlPjwvaDM+PC9pbnM+Cgk8L3Ro Pgo8L3RhYmxlPgo= 286632 2016-08-22 15:40:35 -0700 2016-08-22 15:40:35 -0700 Test reduction bug155702.html text/html 370 zalan PHNjcmlwdD4Kd2luZG93Lm9ubG9hZCA9IGZ1bmN0aW9uKCkgewoJd2luZG93LnNjcm9sbFRvKDAs IGRvY3VtZW50LmJvZHkuc2Nyb2xsSGVpZ2h0KTsKCWRvY3VtZW50LmRlc2lnbk1vZGUgPSAnb24n Owp9Cjwvc2NyaXB0PgoKPHN0eWxlPgpwcmUgewoJbWFyZ2luLXRvcDogLTFweDsKCXBvc2l0aW9u OiByZWxhdGl2ZTsKCWRpc3BsYXk6IGlubGluZS10YWJsZTsKfQoKc3BhbiB7Cglwb3NpdGlvbjog YWJzb2x1dGU7Cn0KPC9zdHlsZT4KCjx0YWJsZT48dHI+PHRoPjxzcGFuPjxkaXY+PHByZT48YT5h PHByZT48c3Bhbj48ZGV0YWlscz48L2RldGFpbHM+PC9zcGFuPjwvcHJlPjwvYT48L3ByZT48L2Rp dj48L3NwYW4+PC90cj48L3RoPjwvdGFibGU+Cg== 286767 2016-08-23 13:50:39 -0700 2016-08-23 14:49:03 -0700 Patch bug-155702-20160823134840.patch text/plain 3999 zalan U3VidmVyc2lvbiBSZXZpc2lvbjogMjA0ODU1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYjY3NmRhMjBlNDVmYjlk OWYzY2Y3MDkxYmI0NTNjZGNlMjdmMjMwMi4uNjZhNDVmZGQ1NGM2MTVmMTg5NzMyNzczODZkMDQ0 Y2UwMTUzZGQwZCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE5IEBACisyMDE2LTA4LTIzICBaYWxh biBCdWp0YXMgIDx6YWxhbkBhcHBsZS5jb20+CisKKyAgICAgICAgQVNTRVJUSU9OIEZBSUxFRDog aGFzT3ZlcmZsb3dpbmdDZWxsID09IHRoaXMtPmhhc092ZXJmbG93aW5nQ2VsbCgpIGluIFdlYkNv cmU6OlJlbmRlclRhYmxlU2VjdGlvbjo6Y29tcHV0ZU92ZXJmbG93RnJvbUNlbGxzCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTU3MDIKKyAgICAgICAg PHJkYXI6Ly9wcm9ibGVtLzI3NzIwNzMxPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgIFRoZSBzaW1wbGlmaWVkIGxheW91dCBwYXRoIGZvciB0YWJsZS9z ZWN0aW9uIHNob3VsZCBhbHNvIGNsZWFyIHRoZSBzbG93IHBhdGggZmxhZyBmb3IgdmlzdWFsIG92 ZXJmbG93IChzaW5jZSBpdCByZWNvbXB1dGVzCisgICAgICAgIHRoZSBvdmVyZmxvdyBmb3IgdGhl IGRlc2NlbmRhbnQgY2VsbHMpLiAKKworICAgICAgICBUZXN0OiBmYXN0L3RhYmxlL2Fzc2VydC13 aGVuLXZpc3VhbC1vdmVyZmxvdy1pcy1jbGVhcmVkLmh0bWwKKworICAgICAgICAqIHJlbmRlcmlu Zy9SZW5kZXJUYWJsZVNlY3Rpb24uY3BwOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVyVGFibGVT ZWN0aW9uOjpsYXlvdXQpOgorCiAyMDE2LTA4LTIzICBBbGV4IENocmlzdGVuc2VuICA8YWNocmlz dGVuc2VuQHdlYmtpdC5vcmc+CiAKICAgICAgICAgRml4IENNYWtlIGJ1aWxkIGFmdGVyIHIyMDQ4 NTIuCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyVGFibGVTZWN0 aW9uLmNwcCBiL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJUYWJsZVNlY3Rpb24uY3Bw CmluZGV4IDE4MmVjODY1OGVkZGM1M2EzMDJhOGE3MmI3MWFkMzdiNzFlZTVhZTUuLmQ5YmMzZjNj NzAwMjcxMzFlNTY5MGI0ZjdiYzhlZjg2OTkwZGQ2Y2EgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJD b3JlL3JlbmRlcmluZy9SZW5kZXJUYWJsZVNlY3Rpb24uY3BwCisrKyBiL1NvdXJjZS9XZWJDb3Jl L3JlbmRlcmluZy9SZW5kZXJUYWJsZVNlY3Rpb24uY3BwCkBAIC0zNzMsNiArMzczLDcgQEAgdm9p ZCBSZW5kZXJUYWJsZVNlY3Rpb246OmxheW91dCgpCiAgICAgQVNTRVJUKCFuZWVkc0NlbGxSZWNh bGMoKSk7CiAgICAgQVNTRVJUKCF0YWJsZSgpLT5uZWVkc1NlY3Rpb25SZWNhbGMoKSk7CiAKKyAg ICBtX2ZvcmNlU2xvd1BhaW50UGF0aFdpdGhPdmVyZmxvd2luZ0NlbGwgPSBmYWxzZTsKICAgICAv LyBhZGRDaGlsZCBtYXkgb3Zlci1ncm93IG1fZ3JpZCBidXQgd2UgZG9uJ3Qgd2FudCB0byB0aHJv dyBhd2F5IHRoZSBtZW1vcnkgdG9vIGVhcmx5IGFzIGFkZENoaWxkCiAgICAgLy8gY2FuIGJlIGNh bGxlZCBpbiBhIGxvb3AgKGUuZyBkdXJpbmcgcGFyc2luZykuIERvaW5nIGl0IG5vdyBlbnN1cmVz IHdlIGhhdmUgYSBzdGFibGUtZW5vdWdoIHN0cnVjdHVyZS4KICAgICBtX2dyaWQuc2hyaW5rVG9G aXQoKTsKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0No YW5nZUxvZwppbmRleCBiNGJkN2NiZTNiOGZkMTAwOTI0ZGI4OGM4YWIxZmI1NjE4MWYwMmRhLi42 MjA0ZGVmYTA4NzFhMTI5MzUzYWNjMmY5ZTlkOTRlZWM4MGM3OGU5IDEwMDY0NAotLS0gYS9MYXlv dXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEs MTQgQEAKKzIwMTYtMDgtMjMgIFphbGFuIEJ1anRhcyAgPHphbGFuQGFwcGxlLmNvbT4KKworICAg ICAgICBBU1NFUlRJT04gRkFJTEVEOiBoYXNPdmVyZmxvd2luZ0NlbGwgPT0gdGhpcy0+aGFzT3Zl cmZsb3dpbmdDZWxsKCkgaW4gV2ViQ29yZTo6UmVuZGVyVGFibGVTZWN0aW9uOjpjb21wdXRlT3Zl cmZsb3dGcm9tQ2VsbHMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu Y2dpP2lkPTE1NTcwMgorICAgICAgICA8cmRhcjovL3Byb2JsZW0vMjc3MjA3MzE+CisKKyAgICAg ICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBmYXN0L3RhYmxlL2Fz c2VydC13aGVuLXZpc3VhbC1vdmVyZmxvdy1pcy1jbGVhcmVkLWV4cGVjdGVkLnR4dDogQWRkZWQu CisgICAgICAgICogZmFzdC90YWJsZS9hc3NlcnQtd2hlbi12aXN1YWwtb3ZlcmZsb3ctaXMtY2xl YXJlZC5odG1sOiBBZGRlZC4KKwogMjAxNi0wOC0yMyAgQnJhZHkgRWlkc29uICA8YmVpZHNvbkBh cHBsZS5jb20+CiAKICAgICAgICAgV0syIEdhbWVwYWQgbGF5b3V0IHRlc3Qgc3VwcG9ydC4KZGlm ZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvdGFibGUvYXNzZXJ0LXdoZW4tdmlzdWFsLW92ZXJm bG93LWlzLWNsZWFyZWQtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC90YWJsZS9hc3Nl cnQtd2hlbi12aXN1YWwtb3ZlcmZsb3ctaXMtY2xlYXJlZC1leHBlY3RlZC50eHQKbmV3IGZpbGUg bW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MC4uNWFjOTMwYmE4NGIwNjVkMGM0NDkzMjZhNTE4ZTQwYzczYzkzMmM3NgotLS0gL2Rldi9udWxs CisrKyBiL0xheW91dFRlc3RzL2Zhc3QvdGFibGUvYXNzZXJ0LXdoZW4tdmlzdWFsLW92ZXJmbG93 LWlzLWNsZWFyZWQtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEsMyBAQAorUEFTUyBpZiBubyBhc3Nl cnQgaW4gZGVidWcuCithIAorICAKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvdGFibGUv YXNzZXJ0LXdoZW4tdmlzdWFsLW92ZXJmbG93LWlzLWNsZWFyZWQuaHRtbCBiL0xheW91dFRlc3Rz L2Zhc3QvdGFibGUvYXNzZXJ0LXdoZW4tdmlzdWFsLW92ZXJmbG93LWlzLWNsZWFyZWQuaHRtbApu ZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwLi4yNDQzMDVlYzA0ZTNjMDA1ZWUwN2RhNDViZDQzYTViYWU3NzRjYTFjCi0tLSAv ZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC90YWJsZS9hc3NlcnQtd2hlbi12aXN1YWwt b3ZlcmZsb3ctaXMtY2xlYXJlZC5odG1sCkBAIC0wLDAgKzEsMjkgQEAKKzwhRE9DVFlQRSBodG1s PgorPGh0bWw+Cis8aGVhZD4KKzx0aXRsZT5UaGlzIHRlc3RzIHRoYXQgdGFibGUgZG9lcyBub3Qg YXNzZXJ0IHdoZW4gY2hpbGQgdmlzdWFsIG92ZXJmbG93IGlzIGNsZWFyZWQuPC90aXRsZT4KKzxz Y3JpcHQ+CitpZiAod2luZG93LnRlc3RSdW5uZXIpCisgICAgdGVzdFJ1bm5lci5kdW1wQXNUZXh0 KCk7CisKK3dpbmRvdy5vbmxvYWQgPSBmdW5jdGlvbigpIHsKKwl3aW5kb3cuc2Nyb2xsVG8oMCwg ZG9jdW1lbnQuYm9keS5zY3JvbGxIZWlnaHQpOworCWRvY3VtZW50LmRlc2lnbk1vZGUgPSAnb24n OworfQorPC9zY3JpcHQ+Cis8c3R5bGU+CitwcmUgeworCW1hcmdpbi10b3A6IC0xcHg7CisJcG9z aXRpb246IHJlbGF0aXZlOworCWRpc3BsYXk6IGlubGluZS10YWJsZTsKK30KKworc3BhbiB7CisJ cG9zaXRpb246IGFic29sdXRlOworfQorPC9zdHlsZT4KKzwvaGVhZD4KKzxib2R5PgorUEFTUyBp ZiBubyBhc3NlcnQgaW4gZGVidWcuCis8dGFibGU+PHRyPjx0aD48c3Bhbj48ZGl2PjxwcmU+PGE+ YTxwcmU+PHNwYW4+PGRldGFpbHM+PC9kZXRhaWxzPjwvc3Bhbj48L3ByZT48L2E+PC9wcmU+PC9k aXY+PC9zcGFuPjwvdHI+PC90aD48L3RhYmxlPgorPC9ib2R5PgpcIE5vIG5ld2xpbmUgYXQgZW5k IG9mIGZpbGUK