Bug 132725

Summary:

ASSERTION FAILED: rangesIntersect(m_renderer.logicalTopForFloat(floatingObject), m_renderer.logicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom)

Product:

WebKit

Reporter:

Simon Fraser (smfr) <simon.fraser>

Component:

Layout and Rendering

Assignee:

Bem Jones-Bey <bjonesbe>

Status:

RESOLVED DUPLICATE

Severity:

Normal

CC:

cand, fujii.hironori, koivisto, simon.fraser

Priority:

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

URL:

http://en.wikipedia.org/wiki/Outline_of_Equatorial_Guinea

Attachments:

Description	Flags
Pared down wikipedia page + css	none

Simon Fraser (smfr)

Reported 2014-05-08 19:24:28 PDT

Seen on http://en.wikipedia.org/wiki/Outline_of_Equatorial_Guinea in the iPad sim (but probably reproduces on desktop too?) ASSERTION FAILED: rangesIntersect(m_renderer.logicalTopForFloat(floatingObject), m_renderer.logicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom) /Volumes/Data/Development/OSX/webkit/OpenSource/Source/WebCore/rendering/FloatingObjects.cpp(464) : void WebCore::ComputeFloatOffsetAdapter<2>::collectIfNeeded(const IntervalType &) [FloatTypeValue = 2] 1 0x111644d10 WTFCrash 2 0x107416895 WebCore::ComputeFloatOffsetAdapter<(WebCore::FloatingObject::Type)2>::collectIfNeeded(WebCore::PODInterval<WebCore::LayoutUnit, WebCore::FloatingObject*> const&) 3 0x10741665e void WebCore::PODIntervalTree<WebCore::LayoutUnit, WebCore::FloatingObject*>::searchForOverlapsFrom<WebCore::ComputeFloatOffsetForLineLayoutAdapter<(WebCore::FloatingObject::Type)2> >(WebCore::PODRedBlackTree<WebCore::PODInterval<WebCore::LayoutUnit, WebCore::FloatingObject*> >::Node*, WebCore::ComputeFloatOffsetForLineLayoutAdapter<(WebCore::FloatingObject::Type)2>&) const 4 0x1074166ab void WebCore::PODIntervalTree<WebCore::LayoutUnit, WebCore::FloatingObject*>::searchForOverlapsFrom<WebCore::ComputeFloatOffsetForLineLayoutAdapter<(WebCore::FloatingObject::Type)2> >(WebCore::PODRedBlackTree<WebCore::PODInterval<WebCore::LayoutUnit, WebCore::FloatingObject*> >::Node*, WebCore::ComputeFloatOffsetForLineLayoutAdapter<(WebCore::FloatingObject::Type)2>&) const 5 0x107416580 void WebCore::PODIntervalTree<WebCore::LayoutUnit, WebCore::FloatingObject*>::allOverlapsWithAdapter<WebCore::ComputeFloatOffsetForLineLayoutAdapter<(WebCore::FloatingObject::Type)2> >(WebCore::ComputeFloatOffsetForLineLayoutAdapter<(WebCore::FloatingObject::Type)2>&) const 6 0x107415032 WebCore::FloatingObjects::logicalRightOffset(WebCore::LayoutUnit, WebCore::LayoutUnit, WebCore::LayoutUnit) 7 0x1084f29e9 WebCore::RenderBlockFlow::logicalRightFloatOffsetForLine(WebCore::LayoutUnit, WebCore::LayoutUnit, WebCore::LayoutUnit) const 8 0x10823cfad WebCore::RenderBlock::logicalRightOffsetForLine(WebCore::LayoutUnit, WebCore::LayoutUnit, bool, WebCore::LayoutUnit) const 9 0x10823ce6f WebCore::RenderBlock::logicalRightOffsetForLine(WebCore::LayoutUnit, bool, WebCore::LayoutUnit) const 10 0x108870551 WebCore::RootInlineBox::selectionTop() const 11 0x108677f18 WebCore::RenderLineBoxList::lineIntersectsDirtyRect(WebCore::RenderBoxModelObject*, WebCore::InlineFlowBox*, WebCore::PaintInfo const&, WebCore::LayoutPoint const&) const 12 0x108678b58 WebCore::RenderLineBoxList::paint(WebCore::RenderBoxModelObject*, WebCore::PaintInfo&, WebCore::LayoutPoint const&) const 13 0x1084f6456 WebCore::RenderBlockFlow::paintInlineChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&) 14 0x1084acecc WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) 15 0x1084adb93 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) 16 0x1084acd0b WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) 17 0x1084ad410 WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) 18 0x1084ad047 WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) 19 0x1084acfce WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) 20 0x1084adb93 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) 21 0x1084acd0b WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) 22 0x1084ad410 WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) 23 0x1084ad047 WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) 24 0x1084acfce WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) 25 0x1084adb93 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) 26 0x1084acd0b WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) 27 0x10861bc15 WebCore::RenderLayer::paintForegroundForFragmentsWithPhase(WebCore::PaintPhase, WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow> const&, WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int, WebCore::RenderObject*) 28 0x108619a58 WebCore::RenderLayer::paintForegroundForFragments(WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow> const&, WebCore::GraphicsContext*, WebCore::GraphicsContext*, WebCore::LayoutRect const&, bool, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int, WebCore::RenderObject*, bool, bool) 29 0x108615453 WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) 30 0x108614a2a WebCore::RenderLayer::paintLayerContentsAndReflection(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int)

Attachments
Pared down wikipedia page + css (24.34 KB, application/x-gzip) 2014-10-28 09:33 PDT, cand	no flags	Details
View All Add attachment proposed patch, testcase, etc.

Bem Jones-Bey

Comment 1 2014-05-12 21:50:12 PDT

I am not able to repro this on my local (desktop) build. Do you have any other examples that show the issue?

Bem Jones-Bey

Comment 2 2014-05-19 14:34:11 PDT

Is this still a problem? Are there any other pages that show the issue?

Bem Jones-Bey

Comment 3 2014-08-19 14:11:14 PDT

I've never been able to repro this myself. Is this still an issue, or should I close it?

cand

Comment 4 2014-10-25 11:10:23 PDT

I'm hitting this too, though on my FLTK port, and not the original URL. My port is based on r169702, and the following wikipedia url repeatedly hits the same assert as the original reporter's: en.wikipedia.org/wiki/Katawa_Shoujo The calltrace is slightly different, though mine is from valgrind: ASSERTION FAILED: rangesIntersect(m_renderer.logicalTopForFloat(floatingObject), m_renderer.logicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom) rendering/FloatingObjects.cpp(464) : void WebCore::ComputeFloatOffsetAdapter<FloatTypeValue>::collectIfNeeded(const IntervalType&) [with WebCore::FloatingObject::Type FloatTypeValue = (WebCore::FloatingObject::Type)2u; WebCore::ComputeFloatOffsetAdapter<FloatTypeValue>::IntervalType = WebCore::PODInterval<WebCore::LayoutUnit, WebCore::FloatingObject*>] by 0x177E8E6: WebCore::FloatingObjects::logicalRightOffset(WebCore::LayoutUnit, WebCore::LayoutUnit, WebCore::LayoutUnit) by 0x172D3A1: WebCore::RenderBlockFlow::logicalRightFloatOffsetForLine(WebCore::LayoutUnit, WebCore::LayoutUnit, WebCore::LayoutUnit) const by 0x1732B70: WebCore::RenderBlockFlow::getClearDelta(WebCore::RenderBox&, WebCore::LayoutUnit) by 0x1734C0A: WebCore::RenderBlockFlow::clearFloatsIfNeeded(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit, WebCore::LayoutUnit, WebCore::LayoutUnit) by 0x173893A: WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) by 0x173904C: WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) by 0x173B60E: WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)

cand

Comment 5 2014-10-28 08:55:00 PDT

The values of the failing range are: rangesintersect 6605.453125 6719.453125 (422749 430045) - 6577.062500 6605.062500 (420932 422724) bool 0 float float raw raw, same order as in the assert. They clearly don't overlap, and that's too big to be a rounding error.

cand

Comment 6 2014-10-28 09:33:01 PDT

Created attachment 240548 [details] Pared down wikipedia page + css Attaching a pared down wikipedia page and css. This still causes the bug for me. Note as the bug depends on the resolution, you may need to set your webkit widget to exactly 800x600 to reproduce.

Fujii Hironori

Comment 7 2022-12-22 13:28:15 PST

*** This bug has been marked as a duplicate of bug 249571 ***

Note You need to log in before you can comment on or make changes to this bug.