Bug 116594 – ASSERTION FAILED: !m_optionsChanged in RenderListBox::computePreferredLogicalWidths

• Component: Forms
• Status: RESOLVED WORKSFORME

[Renata Hodovan]

Created attachment 202504 [details]
Test case

The attached test throws an assertion in RenderListBox.cpp:218.

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff5758c3d in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:339
339	    *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt 10
#0  0x00007ffff5758c3d in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:339
#1  0x00007ffff49cbd07 in WebCore::RenderListBox::computePreferredLogicalWidths (this=0x8a6538)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderListBox.cpp:218
#2  0x00007ffff4900517 in WebCore::RenderBox::maxPreferredLogicalWidth (this=0x8a6538)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBox.cpp:861
#3  0x00007ffff49072b8 in WebCore::RenderBox::computeLogicalWidthInRegionUsing (this=0x8a6538, widthType=WebCore::MainOrPreferredSize, logicalWidth=..., 
    availableLogicalWidth=..., cb=0x787df8, region=0x0, offsetFromLogicalTopOfFirstPage=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBox.cpp:2217
#4  0x00007ffff4906a29 in WebCore::RenderBox::computeLogicalWidthInRegion (this=0x8a6538, computedValues=..., region=0x0, offsetFromLogicalTopOfFirstPage=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBox.cpp:2128
#5  0x00007ffff490635f in WebCore::RenderBox::updateLogicalWidth (this=0x8a6538)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBox.cpp:2063
#6  0x00007ffff489eb1e in WebCore::RenderBlock::updateLogicalWidthAndColumnWidth (this=0x8a6538)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1541
#7  0x00007ffff489eeec in WebCore::RenderBlock::layoutBlock (this=0x8a6538, relayoutChildren=false, pageLogicalHeight=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1593
#8  0x00007ffff489e6a3 in WebCore::RenderBlock::layout (this=0x8a6538) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1432
#9  0x00007ffff49cb9c1 in WebCore::RenderListBox::layout (this=0x8a6538) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderListBox.cpp:177

[Martin Hodovan]

The added test no longer seems valid to me, but I could reproduce the same fail with the following test case.

<svg>
    <symbol onload='document.execCommand("a", true, null)'></symbol>
</svg>
<select autofocus multiple></select>

[Renata Hodovan]

Created attachment 237772 [details]
Repro2

Adding the new test case as attachment.

[Brent Fulgham]

This no longer reproduces under ASAN or GuardMalloc with current sources. r204037.

Please reopen this bug with revised steps to reproduce if you still encounter the problem.