<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>89844</bug_id>
          
          <creation_ts>2012-06-24 19:06:11 -0700</creation_ts>
          <short_desc>REGRESSION(r121124): LayoutTests/fast/block/inline-children-root-linebox-crash.html asserts</short_desc>
          <delta_ts>2012-06-24 19:14:55 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Layout and Rendering</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Antti Koivisto">koivisto</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>eric</cc>
    
    <cc>webkit.review.bot</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>656326</commentid>
    <comment_count>0</comment_count>
    <who name="Antti Koivisto">koivisto</who>
    <bug_when>2012-06-24 19:06:11 -0700</bug_when>
    <thetext>* thread #1: tid = 0x1f03, 0x000000010bad3389 WebCore`WebCore::RenderGeometryMap::absoluteRect(WebCore::FloatRect const&amp;) const + 697 at RenderGeometryMap.cpp:127, stop reason = EXC_BAD_ACCESS (code=1, address=0xbbadbeef)
    frame #0: 0x000000010bad3389 WebCore`WebCore::RenderGeometryMap::absoluteRect(WebCore::FloatRect const&amp;) const + 697 at RenderGeometryMap.cpp:127
    frame #1: 0x000000010bb1cd1e WebCore`WebCore::RenderLayerCompositor::addToOverlapMap(WebCore::RenderLayerCompositor::OverlapMap&amp;, WebCore::RenderLayer*, WebCore::IntRect&amp;, bool&amp;) + 174 at RenderLayerCompositor.cpp:654
    frame #2: 0x000000010bb1acd9 WebCore`WebCore::RenderLayerCompositor::computeCompositingRequirements(WebCore::RenderLayer*, WebCore::RenderLayer*, WebCore::RenderLayerCompositor::OverlapMap*, WebCore::CompositingState&amp;, bool&amp;, bool&amp;) + 1657 at RenderLayerCompositor.cpp:839
    frame #3: 0x000000010bb1abbb WebCore`WebCore::RenderLayerCompositor::computeCompositingRequirements(WebCore::RenderLayer*, WebCore::RenderLayer*, WebCore::RenderLayerCompositor::OverlapMap*, WebCore::CompositingState&amp;, bool&amp;, bool&amp;) + 1371 at RenderLayerCompositor.cpp:822
    frame #4: 0x000000010bb1abbb WebCore`WebCore::RenderLayerCompositor::computeCompositingRequirements(WebCore::RenderLayer*, WebCore::RenderLayer*, WebCore::RenderLayerCompositor::OverlapMap*, WebCore::CompositingState&amp;, bool&amp;, bool&amp;) + 1371 at RenderLayerCompositor.cpp:822
    frame #5: 0x000000010bb1a143 WebCore`WebCore::RenderLayerCompositor::updateCompositingLayers(WebCore::CompositingUpdateType, WebCore::RenderLayer*) + 675 at RenderLayerCompositor.cpp:407
    frame #6: 0x000000010afa688d WebCore`WebCore::FrameView::updateCompositingLayersAfterLayout() + 93 at FrameView.cpp:662
    frame #7: 0x000000010afa83ba WebCore`WebCore::FrameView::layout(bool) + 3530 at FrameView.cpp:1134
    frame #8: 0x000000010afad176 WebCore`WebCore::FrameView::visibleContentsResized() + 86 at FrameView.cpp:1863
    frame #9: 0x000000010bd12c67 WebCore`WebCore::ScrollView::updateScrollbars(WebCore::IntSize const&amp;) + 2215 at ScrollView.cpp:545
    frame #10: 0x000000010bd14510 WebCore`WebCore::ScrollView::setContentsSize(WebCore::IntSize const&amp;) + 176 at ScrollView.cpp:309
    frame #11: 0x000000010afa5ff8 WebCore`WebCore::FrameView::setContentsSize(WebCore::IntSize const&amp;) + 120 at FrameView.cpp:507
    frame #12: 0x000000010afa627a WebCore`WebCore::FrameView::adjustViewSize() + 426 at FrameView.cpp:536
    frame #13: 0x000000010afa82be WebCore`WebCore::FrameView::layout(bool) + 3278 at FrameView.cpp:1120</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>656327</commentid>
    <comment_count>1</comment_count>
      <attachid>149223</attachid>
    <who name="Antti Koivisto">koivisto</who>
    <bug_when>2012-06-24 19:09:15 -0700</bug_when>
    <thetext>Created attachment 149223
patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>656328</commentid>
    <comment_count>2</comment_count>
    <who name="Antti Koivisto">koivisto</who>
    <bug_when>2012-06-24 19:14:55 -0700</bug_when>
    <thetext>http://trac.webkit.org/changeset/121130</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>149223</attachid>
            <date>2012-06-24 19:09:15 -0700</date>
            <delta_ts>2012-06-24 19:11:19 -0700</delta_ts>
            <desc>patch</desc>
            <filename>flipped-writing-assert.patch</filename>
            <type>text/plain</type>
            <size>1607</size>
            <attacher name="Antti Koivisto">koivisto</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi
Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDEyMTEyOCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n
ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBACisyMDEyLTA2LTI0ICBBbnR0aSBL
b2l2aXN0byAgPGFudHRpQGFwcGxlLmNvbT4KKworICAgICAgICBSRUdSRVNTSU9OKHIxMjExMjQp
OiBMYXlvdXRUZXN0cy9mYXN0L2Jsb2NrL2lubGluZS1jaGlsZHJlbi1yb290LWxpbmVib3gtY3Jh
c2guaHRtbCBhc3NlcnRzCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn
LmNnaT9pZD04OTg0NAorCisgICAgICAgIFdlIG5lZWQgdG8gY2hlY2sgZm9yIHRoZSBmbGlwcGVk
IHdyaXRpbmcgbW9kZSBhbmQgdGFrZSB0aGUgc2xvdyBwYXRoIGlmIGl0IGlzIHVzZWQuCisKKyAg
ICAgICAgKiByZW5kZXJpbmcvUmVuZGVyR2VvbWV0cnlNYXAuY3BwOgorICAgICAgICAoV2ViQ29y
ZTo6UmVuZGVyR2VvbWV0cnlNYXA6OnB1c2hNYXBwaW5nc1RvQW5jZXN0b3IpOgorCiAyMDEyLTA2
LTIyICBLZW50IFRhbXVyYSAgPHRrZW50QGNocm9taXVtLm9yZz4KIAogICAgICAgICBTZWxlY3Rl
ZCBvcHRpb24gaXMgbm90IHJlc3RvcmVkIGNvcnJlY3RseQpJbmRleDogU291cmNlL1dlYkNvcmUv
cmVuZGVyaW5nL1JlbmRlckdlb21ldHJ5TWFwLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi
Q29yZS9yZW5kZXJpbmcvUmVuZGVyR2VvbWV0cnlNYXAuY3BwCShyZXZpc2lvbiAxMjExMjUpCisr
KyBTb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyR2VvbWV0cnlNYXAuY3BwCSh3b3JraW5n
IGNvcHkpCkBAIC0xODUsNyArMTg1LDcgQEAgdm9pZCBSZW5kZXJHZW9tZXRyeU1hcDo6cHVzaE1h
cHBpbmdzVG9BbgogICAgIGNvbnN0IFJlbmRlck9iamVjdCogcmVuZGVyZXIgPSBsYXllci0+cmVu
ZGVyZXIoKTsKIAogICAgIC8vIFRoZSBzaW1wbGUgY2FzZSBjYW4gYmUgaGFuZGxlZCBmYXN0IGlu
IHRoZSBsYXllciB0cmVlLgotICAgIGJvb2wgY2FuQ29udmVydEluTGF5ZXJUcmVlID0gYW5jZXN0
b3JMYXllciAmJiByZW5kZXJlci0+c3R5bGUoKS0+cG9zaXRpb24oKSAhPSBGaXhlZFBvc2l0aW9u
OworICAgIGJvb2wgY2FuQ29udmVydEluTGF5ZXJUcmVlID0gYW5jZXN0b3JMYXllciAmJiByZW5k
ZXJlci0+c3R5bGUoKS0+cG9zaXRpb24oKSAhPSBGaXhlZFBvc2l0aW9uICYmICFyZW5kZXJlci0+
c3R5bGUoKS0+aXNGbGlwcGVkQmxvY2tzV3JpdGluZ01vZGUoKTsKICAgICBmb3IgKGNvbnN0IFJl
bmRlckxheWVyKiBjdXJyZW50ID0gbGF5ZXI7IGN1cnJlbnQgIT0gYW5jZXN0b3JMYXllciAmJiBj
YW5Db252ZXJ0SW5MYXllclRyZWU7IGN1cnJlbnQgPSBjdXJyZW50LT5wYXJlbnQoKSkKICAgICAg
ICAgY2FuQ29udmVydEluTGF5ZXJUcmVlID0gY3VycmVudC0+Y2FuVXNlQ29udmVydFRvTGF5ZXJD
b29yZHMoKTsKIAo=
</data>
<flag name="review"
          id="157179"
          type_id="1"
          status="+"
          setter="mitz"
    />
          </attachment>
      

    </bug>

</bugzilla>