Bug 140185

Summary: ASSERTION FAILED: enclosingIntRect(rendererMappedResult) == enclosingIntRect(result.boundingBox()) in WebCore::RenderGeometryMap::mapToContainer
Product: WebKit Reporter: Renata Hodovan <rhodovan.u-szeged>
Component: Layout and RenderingAssignee: Nobody <webkit-unassigned>
Status: RESOLVED WORKSFORME    
Severity: Normal CC: bfulgham, simon.fraser, zalan
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 116980    
Attachments:
Description Flags
Test case none

Description Renata Hodovan 2015-01-07 10:42:53 PST 
Created attachment 244165 [details]
Test case

Load this with debug WK:

<!DOCTYPE html>
<style>
* {
    margin: auto 4971%;
}
</style>
<fieldset>
    <sub dir="rtl">
        <dfn>
            <keygen autofocus>
            <textarea></textarea>
            <footer><input/></footer>
        </dfn>
    </sub>
</fieldset>

This might be another repro of https://bugs.webkit.org/show_bug.cgi?id=108619.


Backtrace:

ASSERTION FAILED: enclosingIntRect(rendererMappedResult) == enclosingIntRect(result.boundingBox())
../../Source/WebCore/rendering/RenderGeometryMap.cpp(141) : WebCore::FloatQuad WebCore::RenderGeometryMap::mapToContainer(const WebCore::FloatRect&, const WebCore::RenderLayerModelObject*) const

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fff98984700 (LWP 31676)]
0x00007fffed92a5c7 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321
321	    *(int *)(uintptr_t)0xbbadbeef = 0;
#0  0x00007fffed92a5c7 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321
#1  0x00007ffff394252d in WebCore::RenderGeometryMap::mapToContainer (this=0x7fffffffca50, rect=..., container=0x0) at ../../Source/WebCore/rendering/RenderGeometryMap.cpp:141
#2  0x00007ffff38bd9b6 in WebCore::RenderBox::outlineBoundsForRepaint (this=0x7fff983eccc0, repaintContainer=0x0, geometryMap=0x7fffffffca50) at ../../Source/WebCore/rendering/RenderBox.cpp:683
#3  0x00007ffff396966a in WebCore::RenderLayer::computeRepaintRects (this=0x7fff983ebd80, repaintContainer=0x0, geometryMap=0x7fffffffca50) at ../../Source/WebCore/rendering/RenderLayer.cpp:674
#4  0x00007ffff39688d6 in WebCore::RenderLayer::updateLayerPositions (this=0x7fff983ebd80, geometryMap=0x7fffffffca50, flags=13) at ../../Source/WebCore/rendering/RenderLayer.cpp:395
#5  0x00007ffff3968c0f in WebCore::RenderLayer::updateLayerPositions (this=0x7ffff7f367e0, geometryMap=0x7fffffffca50, flags=13) at ../../Source/WebCore/rendering/RenderLayer.cpp:450
#6  0x00007ffff3968c0f in WebCore::RenderLayer::updateLayerPositions (this=0x7ffff7f36b40, geometryMap=0x7fffffffca50, flags=13) at ../../Source/WebCore/rendering/RenderLayer.cpp:450
#7  0x00007ffff396862c in WebCore::RenderLayer::updateLayerPositionsAfterLayout (this=0x7ffff7f36b40, rootLayer=0x7ffff7f36b40, flags=13) at ../../Source/WebCore/rendering/RenderLayer.cpp:353
#8  0x00007ffff35c9b5f in WebCore::FrameView::layout (this=0x7ffff7ec9b00, allowSubtree=true) at ../../Source/WebCore/page/FrameView.cpp:1357
#9  0x00007ffff2f883a7 in WebCore::Document::implicitClose (this=0x7ffff7e49000) at ../../Source/WebCore/dom/Document.cpp:2464
#10 0x00007ffff347376f in WebCore::FrameLoader::checkCallImplicitClose (this=0x7ffff7f3ca98) at ../../Source/WebCore/loader/FrameLoader.cpp:909
#11 0x00007ffff34734db in WebCore::FrameLoader::checkCompleted (this=0x7ffff7f3ca98) at ../../Source/WebCore/loader/FrameLoader.cpp:855
#12 0x00007ffff3473244 in WebCore::FrameLoader::finishedParsing (this=0x7ffff7f3ca98) at ../../Source/WebCore/loader/FrameLoader.cpp:775
#13 0x00007ffff2f91302 in WebCore::Document::finishedParsing (this=0x7ffff7e49000) at ../../Source/WebCore/dom/Document.cpp:4597
#14 0x00007ffff32ee375 in WebCore::HTMLConstructionSite::finishedParsing (this=0x7ffff7f36920) at ../../Source/WebCore/html/parser/HTMLConstructionSite.cpp:404
#15 0x00007ffff332aec0 in WebCore::HTMLTreeBuilder::finished (this=0x7ffff7f36900) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2941
#16 0x00007ffff32f6be6 in WebCore::HTMLDocumentParser::end (this=0x7ffff7ed0100) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:425
#17 0x00007ffff32f6cb4 in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd (this=0x7ffff7ed0100) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:434
#18 0x00007ffff32f5940 in WebCore::HTMLDocumentParser::prepareToStopParsing (this=0x7ffff7ed0100) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:153
#19 0x00007ffff32f6ceb in WebCore::HTMLDocumentParser::attemptToEnd (this=0x7ffff7ed0100) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:446
#20 0x00007ffff32f6d99 in WebCore::HTMLDocumentParser::finish (this=0x7ffff7ed0100) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:474
#21 0x00007ffff3463885 in WebCore::DocumentWriter::end (this=0x7ffff7ebcaa0) at ../../Source/WebCore/loader/DocumentWriter.cpp:247
#22 0x00007ffff344f029 in WebCore::DocumentLoader::finishedLoading (this=0x7ffff7ebca00, finishTime=0) at ../../Source/WebCore/loader/DocumentLoader.cpp:440
#23 0x00007ffff344ed92 in WebCore::DocumentLoader::notifyFinished (this=0x7ffff7ebca00, resource=0x7ffff7ec9680) at ../../Source/WebCore/loader/DocumentLoader.cpp:374
#24 0x00007ffff3501e1e in WebCore::CachedResource::checkNotify (this=0x7ffff7ec9680) at ../../Source/WebCore/loader/cache/CachedResource.cpp:294
#25 0x00007ffff3501f1c in WebCore::CachedResource::finishLoading (this=0x7ffff7ec9680) at ../../Source/WebCore/loader/cache/CachedResource.cpp:310
#26 0x00007ffff34fe617 in WebCore::CachedRawResource::finishLoading (this=0x7ffff7ec9680, data=0x7ffff7e42570) at ../../Source/WebCore/loader/cache/CachedRawResource.cpp:104
#27 0x00007ffff34b1886 in WebCore::SubresourceLoader::didFinishLoading (this=0x7ffff7ec9200, finishTime=0) at ../../Source/WebCore/loader/SubresourceLoader.cpp:355
#28 0x00007ffff34ad4e7 in WebCore::ResourceLoader::didFinishLoading (this=0x7ffff7ec9200, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:506
#29 0x00007ffff3e58c65 in WebCore::readCallback (asyncResult=0x6d69a0, data=0x7ffff7e390e0) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1295
#30 0x00007fffeb4cc7d6 in async_ready_callback_wrapper (source_object=0x7c8ad0, res=0x6d69a0, user_data=user_data@entry=0x7ffff7e390e0) at ginputstream.c:523
#31 0x00007fffeb4f20d5 in g_task_return_now (task=0x6d69a0) at gtask.c:1077
#32 0x00007fffeb4f20f9 in complete_in_idle_cb (task=0x6d69a0) at gtask.c:1086
#33 0x00007fffea7319fd in g_main_dispatch (context=0x478330) at gmain.c:3064
#34 g_main_context_dispatch (context=context@entry=0x478330) at gmain.c:3663
#35 0x00007fffea731d68 in g_main_context_iterate (context=0x478330, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3734
#36 0x00007fffea73202a in g_main_loop_run (loop=0x8fd8e0) at gmain.c:3928
#37 0x00007ffff4537450 in WTF::RunLoop::run () at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:59
#38 0x00007ffff2a65456 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffd898) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61
#39 0x00007ffff2a652bb in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffd898) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:70
#40 0x0000000000400891 in main (argc=2, argv=0x7fffffffd898) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:44
Comment 1 zalan 2015-01-07 12:44:01 PST 
(const WebCore::FloatRect &) rect = 0x00007fff4fcef738: {
  m_location = (m_x = -32042248, m_y = 68.59375)
  m_size = (m_width = 130, m_height = 13)
}

vs.

(const WebCore::FloatRect &) rect = 0x00007fff4fcef758: {
  m_location = (m_x = -31980808, m_y = 68.59375)
  m_size = (m_width = 130, m_height = 13)
}

m_x looks very different when we compute it through the m_renderer->localToContainerQuad() path.
Comment 2 Brent Fulgham 2016-08-04 13:01:50 PDT 
This does not seem to reproduce under r204307. If you believe there is still a problem, please reopen the bug with a revised test case.