Summary: | Assertion in RenderGeometryMap::mapToContainer with LayoutUnit overflow | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Renata Hodovan <rhodovan.u-szeged> | ||||||||
Component: | Layout and Rendering | Assignee: | zalan <zalan> | ||||||||
Status: | RESOLVED FIXED | ||||||||||
Severity: | Normal | CC: | commit-queue, eae, esprehn+autocc, glenn, jberlin, kondapallykalyan, leviw, simon.fraser, zalan | ||||||||
Priority: | P2 | Keywords: | InRadar | ||||||||
Version: | 528+ (Nightly build) | ||||||||||
Hardware: | Unspecified | ||||||||||
OS: | Unspecified | ||||||||||
Bug Depends on: | |||||||||||
Bug Blocks: | 116980 | ||||||||||
Attachments: |
|
Description
Renata Hodovan
2013-02-01 05:23:52 PST
font-size: 354em; This looks like layoutunit overflow. Simon is right, that is almost certainly due to overflow. Try to run with SATURATED_LAYOUT_ARITHMETIC enabled and see if it still happens. Created attachment 237777 [details]
Repro
The original test case does not reproduce the issue anymore. However the attached one still does.
*** Bug 119627 has been marked as a duplicate of this bug. *** After the geometry map assertion, this asserts at: ASSERTION FAILED: y2 >= y1 /Volumes/DataSSD/Development/apple/webkit/OpenSource/Source/WebCore/rendering/RenderObject.cpp(923) : void WebCore::RenderObject::drawLineForBoxSide(WebCore::GraphicsContext *, float, float, float, float, WebCore::BoxSide, WebCore::Color, WebCore::EBorderStyle, float, float, bool) const 1 0x1033c9870 WTFCrash 2 0x10615dc97 WebCore::RenderObject::drawLineForBoxSide(WebCore::GraphicsContext*, float, float, float, float, WebCore::BoxSide, WebCore::Color, WebCore::EBorderStyle, float, float, bool) const 3 0x10615d89f WebCore::RenderObject::drawLineForBoxSide(WebCore::GraphicsContext*, float, float, float, float, WebCore::BoxSide, WebCore::Color, WebCore::EBorderStyle, float, float, bool) const 4 0x10615fb5f WebCore::RenderObject::paintOutline(WebCore::PaintInfo&, WebCore::LayoutRect const&) 5 0x1061731be WebCore::RenderReplaced::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) 6 0x106086afa WebCore::RenderImage::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) 7 0x105f5dc20 WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) 8 0x105f5d857 WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) (lldb) p y1 (float) $1 = 5 (lldb) p y2 (float) $2 = -33554432 With certain (big enough)values, the following code fails FloatRect rect(big number, big number, big number, big number); FloatQuad quad(rect); assert(rect.size() == quad.size()) because FloatQuad stores top left bottom right values internally -> float approx. value -> rect.m_size != quad.FloatRect(left, top, right - left, bottom - top).m_size Created attachment 244102 [details]
Patch
Comment on attachment 244102 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=244102&action=review > LayoutTests/fast/block/geometry-map-assertion-with-tall-content.html:10 > +<![CDATA[ > +* {} > +* { > + display:table-caption; > + outline-style:ridge; > + overflow-x:auto; > +} This could be less crazy Created attachment 244105 [details]
Patch
Comment on attachment 244105 [details] Patch Clearing flags on attachment: 244105 Committed r178009: <http://trac.webkit.org/changeset/178009> All reviewed patches have been landed. Closing bug. |