Bug 108452
| Summary: | ASSERT(clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRectsType]) in RenderLayer | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Renata Hodovan <rhodovan.u-szeged> |
| Component: | CSS | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | Normal | CC: | simon.fraser |
| Priority: | P2 | ||
| Version: | 528+ (Nightly build) | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Renata Hodovan
I've got the following assert during HTML fuzzing:
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff44927b8 in WebCore::RenderLayer::updateClipRects (this=0x7c70d8, clipRectsContext=...)
at /home/reni/WebKit-git/Source/WebCore/rendering/RenderLayer.cpp:4521
4521 ASSERT(clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRectsType]);
The test:
<html>
<body style="-webkit-column-count: 2; -webkit-column-gap: 0">
<div style="overflow: scroll">
<div style="position: absolute;"></div>
<div style="-webkit-box-reflect: below 2px"></div>
</div>
</body>
</html>
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Simon Fraser (smfr)
*** This bug has been marked as a duplicate of bug 108257 ***