Bug 123486

Summary: ASSERTION FAILED: m_repaintRect == renderer().clippedOverflowRectForRepaint(renderer().containerForRepaint())
Product: WebKit Reporter: Ryosuke Niwa <rniwa>
Component: Layout and RenderingAssignee: Nobody <webkit-unassigned>
Status: RESOLVED DUPLICATE    
Severity: Normal CC: bdakin, dino, simon.fraser, thorton, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   

Description Ryosuke Niwa 2013-10-29 19:20:49 PDT
Reproduction steps:
1. Log into Facebook.com
2. Open an image people posted on timeline

ASSERTION FAILED: m_repaintRect == renderer().clippedOverflowRectForRepaint(renderer().containerForRepaint())
/Volumes/Data/webkit2/Source/WebCore/rendering/RenderLayer.cpp(788) : void WebCore::RenderLayer::updateLayerPositionsAfterScroll(WebCore::RenderGeometryMap *, UpdateLayerPositionsAfterScrollFlags)
1   0x10eea39d0 WTFCrash
2   0x11122133b WebCore::RenderLayer::updateLayerPositionsAfterScroll(WebCore::RenderGeometryMap*, unsigned int)
3   0x111221419 WebCore::RenderLayer::updateLayerPositionsAfterScroll(WebCore::RenderGeometryMap*, unsigned int)
4   0x1112210c1 WebCore::RenderLayer::updateLayerPositionsAfterDocumentScroll()
5   0x110565dbf WebCore::FrameView::repaintFixedElementsAfterScrolling()
6   0x1114aa9b5 WebCore::ScrollView::scrollTo(WebCore::IntSize const&)
7   0x11056884e WebCore::FrameView::scrollTo(WebCore::IntSize const&)
8   0x1114aa8bf WebCore::ScrollView::setScrollOffset(WebCore::IntPoint const&)
9   0x1114aa8ff non-virtual thunk to WebCore::ScrollView::setScrollOffset(WebCore::IntPoint const&)
10  0x11146f780 WebCore::ScrollableArea::scrollPositionChanged(WebCore::IntPoint const&)
11  0x11146f6ef WebCore::ScrollableArea::notifyScrollPositionChanged(WebCore::IntPoint const&)
12  0x111488c2f WebCore::ScrollingCoordinator::updateMainFrameScrollPosition(WebCore::IntPoint const&, bool, WebCore::SetOrSyncScrollingLayerPosition)
13  0x11148b4b3 WebCore::ScrollingCoordinatorMac::requestScrollPositionUpdate(WebCore::FrameView*, WebCore::IntPoint const&)
14  0x110566251 WebCore::FrameView::requestScrollPositionUpdate(WebCore::IntPoint const&)
15  0x1105662af non-virtual thunk to WebCore::FrameView::requestScrollPositionUpdate(WebCore::IntPoint const&)
16  0x11146fae2 WebCore::ScrollableArea::setScrollOffsetFromAnimation(WebCore::IntPoint const&)
17  0x111472181 WebCore::ScrollAnimator::notifyPositionChanged(WebCore::FloatSize const&)
18  0x111476956 WebCore::ScrollAnimatorMac::notifyPositionChanged(WebCore::FloatSize const&)
19  0x11147649a WebCore::ScrollAnimatorMac::immediateScrollTo(WebCore::FloatPoint const&)
20  0x111476373 WebCore::ScrollAnimatorMac::scrollToOffsetWithoutAnimation(WebCore::FloatPoint const&)
21  0x11146f5cc WebCore::ScrollableArea::scrollToOffsetWithoutAnimation(WebCore::FloatPoint const&)
22  0x1114a930d WebCore::ScrollView::updateScrollbars(WebCore::IntSize const&)
23  0x1114a9e40 WebCore::ScrollView::setContentsSize(WebCore::IntSize const&)
24  0x11055dd81 WebCore::FrameView::setContentsSize(WebCore::IntSize const&)
25  0x11055f223 WebCore::FrameView::adjustViewSize()
26  0x11056192a WebCore::FrameView::layout(bool)
27  0x11029e568 WebCore::Document::updateLayout()
28  0x1102a177f WebCore::Document::updateLayoutIgnorePendingStylesheets()
29  0x110417177 WebCore::Element::offsetHeight()
30  0x110ae6737 WebCore::jsElementOffsetHeight(JSC::ExecState*, JSC::JSValue, JSC::PropertyName)
31  0x10e83ea0f JSC::PropertySlot::getValue(JSC::ExecState*, JSC::PropertyName) const
Comment 1 Radar WebKit Bug Importer 2013-10-29 19:21:14 PDT
<rdar://problem/15348150>
Comment 2 Simon Fraser (smfr) 2013-11-11 17:56:41 PST
See also bug 103432
Comment 3 Simon Fraser (smfr) 2013-11-11 18:03:43 PST
I think the issue here is that FrameView::layout() does adjustViewSize() before updateLayerPositionsAfterLayout(), but adjustViewSize() can cause scrolling.
Comment 4 Simon Fraser (smfr) 2013-11-13 11:17:11 PST

*** This bug has been marked as a duplicate of bug 103432 ***