Bug 153576 – ASSERTION FAILED: roundedIntPoint(rendererMappedResult) == roundedIntPoint(result)

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[Fujii Hironori]

Created attachment 270075 [details]
test content

ASSERTION FAILED: roundedIntPoint(rendererMappedResult) == roundedIntPoint(result)

trunk@195653, MiniBrowser, Gtk port, Debug build.

> fujii@vm-ubuntu $ ./Tools/Scripts/run-minibrowser --gtk ~/tmp/a.html
> Starting MiniBrowser.
> 
> (MiniBrowser:7957): GLib-GObject-WARNING **: The property GtkToolButton:stock-id is deprecated and shouldn't be used anymore. It will be removed in a future version.
> ASSERTION FAILED: roundedIntPoint(rendererMappedResult) == roundedIntPoint(result)
> ../../Source/WebCore/rendering/RenderGeometryMap.cpp(118) : WebCore::FloatPoint WebCore::RenderGeometryMap::mapToContainer(const WebCore::FloatPoint&, const WebCore::RenderLayerModelObject*) const
> 1   0x7fa703f110e1 /home/fujii/work/webkit/github/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(WTFCrash+0x1e) [0x7fa703f110e1]
> 2   0x7fa70da25b39 /home/fujii/work/webkit/github/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZNK7WebCore17RenderGeometryMap14mapToContainerERKNS_10FloatPointEPKNS_22RenderLayerModelObjectE+0x223) [0x7fa70da25b39]
> 3   0x7fa70da78624 /home/fujii/work/webkit/github/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZNK7WebCore17RenderGeometryMap13absolutePointERKNS_10FloatPointE+0x28) [0x7fa70da78624]
> 4   0x7fa70da57a66 /home/fujii/work/webkit/github/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN7WebCore11RenderLayer20updateLayerPositionsEPNS_17RenderGeometryMapEj+0xda) [0x7fa70da57a66]
> 5   0x7fa70da57f4f /home/fujii/work/webkit/github/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN7WebCore11RenderLayer20updateLayerPositionsEPNS_17RenderGeometryMapEj+0x5c3) [0x7fa70da57f4f]
> 6   0x7fa70da57f4f /home/fujii/work/webkit/github/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN7WebCore11RenderLayer20updateLayerPositionsEPNS_17RenderGeometryMapEj+0x5c3) [0x7fa70da57f4f]
> 7   0x7fa70da57f4f /home/fujii/work/webkit/github/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN7WebCore11RenderLayer20updateLayerPositionsEPNS_17RenderGeometryMapEj+0x5c3) [0x7fa70da57f4f]
> 8   0x7fa70da5793f /home/fujii/work/webkit/github/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN7WebCore11RenderLayer31updateLayerPositionsAfterLayoutEPKS0_j+0x9d) [0x7fa70da5793f]
> 9   0x7fa70d630a13 /home/fujii/work/webkit/github/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN7WebCore9FrameView6layoutEb+0x10a3) [0x7fa70d630a13]
> 10  0x7fa70cf4b7e6 /home/fujii/work/webkit/github/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN7WebCore8Document33updateLayoutIfDimensionsOutOfDateERNS_7ElementENS_15DimensionsCheckE+0x586) [0x7fa70cf4b7e6]
> 11  0x7fa70cfbd6c1 /home/fujii/work/webkit/github/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN7WebCore7Element11offsetWidthEv+0x3f) [0x7fa70cfbd6c1]
> 12  0x7fa70e17b890 /home/fujii/work/webkit/github/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN7WebCore20jsElementOffsetWidthEPN3JSC9ExecStateEPNS0_8JSObjectElNS0_12PropertyNameE+0xb9) [0x7fa70e17b890]
> 13  0x7fa70c5b1a61 /home/fujii/work/webkit/github/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZNK3JSC12PropertySlot8getValueEPNS_9ExecStateENS_12PropertyNameE+0x93) [0x7fa70c5b1a61]
> 14  0x7fa70cc61d37 /home/fujii/work/webkit/github/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZNK3JSC7JSValue3getEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE+0x4b) [0x7fa70cc61d37]
> 15  0x7fa703dcb54b /home/fujii/work/webkit/github/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(+0x19f454b) [0x7fa703dcb54b]
> 16  0x7fa703dd71a9 /home/fujii/work/webkit/github/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(+0x1a001a9) [0x7fa703dd71a9]
> fujii@vm-ubuntu $

[Fujii Hironori]

I guess this seems a same problem with a following bug:

Bug 151030 – ASSERTION FAILED: roundedIntPoint(rendererMappedResult) == roundedIntPoint(result) in WebCore::RenderGeometryMap::mapToContainer

[Said Abou-Hallawa]

In general I think using the roundIntPoint() for this assertion does not seem right. For example if we have, rendererMappedResult={2.4999, 3} and result={2.5, 3}, the assertion will fail although it should not.

Maybe we can use something like:

ASSERT((rendererMappedResult - result).lengthSquared() < some_epsilon);

But we may have another bug which makes RenderGeometryMap::mapToContainer() returns inconsistent values.

[Fujii Hironori]

Created attachment 270196 [details]
patch

This seems caused by the uniqueness of LayoutUnit::round introduced by the following bug:

  Bug 107208 – LayoutUnit should round half consistently, not away from zero

LayoutUnit::round of -1.5 is -1, not -2.

Should convert to LayoutPoint once because of the uniqueness of LayoutUnit::round.

This patch does not solve Bug 151030, it seems different bug.

[Fujii Hironori]

Created attachment 270462 [details]
Patch

[Darin Adler]

Comment on attachment 270462 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=270462&action=review

Please post a new version of the patch with the unnecessary #if/#endif pairs removed.

> Source/WebCore/rendering/RenderGeometryMap.cpp:113
> +#if !ASSERT_DISABLED

This #if is not needed and should not be added. ASSERT takes care of this already.

> Source/WebCore/rendering/RenderGeometryMap.cpp:121
>  #if !ASSERT_DISABLED

This #if is no longer needed and should be removed. It was here because of the code outside the assert that has now been moved elsewhere. ASSERT takes care of this already.

[Fujii Hironori]

Created attachment 270533 [details]
Patch

[Fujii Hironori]

(In reply to comment #5)
> Please post a new version of the patch with the unnecessary #if/#endif pairs
> removed.

Thank you for reviewing. I updated the patch.

[WebKit Commit Bot]

Comment on attachment 270533 [details]
Patch

Clearing flags on attachment: 270533

Committed r196052: <http://trac.webkit.org/changeset/196052>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Alex Christensen]

Comment on attachment 270533 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=270533&action=review

> Source/WebCore/rendering/RenderGeometryMap.cpp:119
> +        ASSERT(rendererMappedResult == result);

This assertion fails after logging in on drive.google.com.  The values are close, but not equal.

[Fujii Hironori]

I'm sorry. Filed another bug:

  Bug 155580 – ASSERTION FAILED: rendererMappedResult == result in RenderGeometryMap::mapToContainer