Bug 118269 – 100% repro assertion failure with testcase (m_repaintRect == renderer()->clippedOverflowRectForRepaint(renderer()->containerForRepaint()))

• Component: Layout and Rendering
• Status: NEW

[Tim Horton]

The attached testcase reproduces this assertion 100% of the time in DumpRenderTree, but (not yet) in Safari or Minibrowser. Similar to https://bugs.webkit.org/show_bug.cgi?id=103432.

[Tim Horton]

Created attachment 205847 [details]
testcase

[Tim Horton]

I’m going to land this testcase with https://bugs.webkit.org/show_bug.cgi?id=118176.

[Allan Sandfeld Jensen]

(In reply to comment #2)
> I’m going to land this testcase with https://bugs.webkit.org/show_bug.cgi?id=118176.

If the test-case is landed, does that mean the bug is fixed or is the test now partially failing?

[Tim Horton]

(In reply to comment #3)
> (In reply to comment #2)
> > I’m going to land this testcase with https://bugs.webkit.org/show_bug.cgi?id=118176.
> 
> If the test-case is landed, does that mean the bug is fixed or is the test now partially failing?

Partially skipped.

[Tobias Netzel]

I can reproduce this in both Safari 5.0.6 and Minibrowser WK1 by doing the following (you'll need a google account for this):

1. go to [http://code.google.com/p/chromium/issues/detail?id=244592]
2. log in
3. scroll down and click in the box to add new comment, so that the text input cursor is blinking in that box
4. scroll up

Here the crash upon scrolling is "enabled" by the fact of having clicked in the box. Clicking inside the box and then clicking outside of it doesn't "disable" it.

[Alexey Proskuryakov]

Looks like this causes heavily broken rendering in release mode.

[Alexey Proskuryakov]

To clarify, I know that this test renders wrong in release builds (tracked internally at Apple as <rdar://problem/14391146>), I don't know how closely that's related to the assertion failure.

[Michael Catanzaro]

*** Bug 152722 has been marked as a duplicate of this bug. ***