Bug 110270

Summary: Lots of LayoutUnit assertions when loading a Wikipedia article
Product: WebKit Reporter: Tim Horton <thorton>
Component: Layout and RenderingAssignee: Emil A Eklund <eae>
Status: RESOLVED FIXED    
Severity: Normal CC: eae, eric, esprehn+autocc, leviw, ojan.autocc, simon.fraser, webkit.review.bot
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
WebArchive which reproduces
none
Patch none

Tim Horton
Reported 2013-02-19 15:27:33 PST
When loading http://en.wikipedia.org/wiki/Turban_Head_eagle (today's Wikipedia featured article) in a ToT (r143269) debug build, I get lots of non-fatal LayoutUnit assertions: Source/WebCore/platform/LayoutUnit.h(180) : unsigned int WebCore::LayoutUnit::toUnsigned() const ERROR: !(isInBounds(value)) Source/WebCore/platform/LayoutUnit.h(338) : void WebCore::LayoutUnit::setValue(unsigned int) ERROR: !(m_value >= 0) Source/WebCore/platform/LayoutUnit.h(180) : unsigned int WebCore::LayoutUnit::toUnsigned() const ERROR: !(isInBounds(value)) Source/WebCore/platform/LayoutUnit.h(338) : void WebCore::LayoutUnit::setValue(unsigned int)
Attachments
WebArchive which reproduces (1.05 MB, application/x-webarchive)
2013-02-19 15:28 PST, Tim Horton 		no flags
Details
Patch (1.79 KB, patch)
2013-02-21 16:42 PST, Emil A Eklund 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Tim Horton
Comment 1 2013-02-19 15:28:14 PST
Created attachment 189184 [details] WebArchive which reproduces
Emil A Eklund
Comment 2 2013-02-19 15:59:24 PST
(In reply to comment #0) > When loading http://en.wikipedia.org/wiki/Turban_Head_eagle (today's Wikipedia featured article) in a ToT (r143269) debug build, I get lots of non-fatal LayoutUnit assertions: > > Source/WebCore/platform/LayoutUnit.h(180) : unsigned int WebCore::LayoutUnit::toUnsigned() const > ERROR: !(isInBounds(value)) > Source/WebCore/platform/LayoutUnit.h(338) : void WebCore::LayoutUnit::setValue(unsigned int) > ERROR: !(m_value >= 0) > Source/WebCore/platform/LayoutUnit.h(180) : unsigned int WebCore::LayoutUnit::toUnsigned() const > ERROR: !(isInBounds(value)) > Source/WebCore/platform/LayoutUnit.h(338) : void WebCore::LayoutUnit::setValue(unsigned int) The column code strikes again. If the startOffset in RenderBlock::adjustRectForColumns is negative the startColumn computation will give a negative value and assigning that to an unsigned is what triggers the assertions. Not quite sure that the right fix is.
Emil A Eklund
Comment 3 2013-02-21 16:42:27 PST
Created attachment 189637 [details] Patch
WebKit Review Bot
Comment 4 2013-02-21 17:12:47 PST
Comment on attachment 189637 [details] Patch Clearing flags on attachment: 189637 Committed r143669: <http://trac.webkit.org/changeset/143669>
WebKit Review Bot
Comment 5 2013-02-21 17:12:51 PST
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.