Bug 271905 – ASAN_TRAP | WebCore::RenderObject::destroy; WebCore::Document::destroyRenderTree; WebCore::Document::willBeRemovedFromFrame

• Component: Layout and Rendering
• Status: RESOLVED DUPLICATE

[John Wilander]

Created attachment 470670 [details]
Repro case

<rdar://125580138>

See attached repro case.

[Frédéric Wang (:fredw)]

This is a duplicate of bug 271903. It is similar to bug 268770, but with a RenderInline ruby split into multiple continuations because of forced line breaks caused by block descendants. RELEASE_ASSERT(!m_previous) fails in WebCore::RenderObject::destroy, with a misparented m_previous. It was badly attached in RenderTreeBuilder::Ruby::attachForStyleBasedRuby with the following bad configuration:

      RenderView at (0,0) size 0x0 renderer (0x7f363e0007a0) layout box ((nil)) layout->[normal child]
        HTML RenderBlock at (0,0) size 0x0 renderer (0x7f363e0015e0) layout box ((nil)) node (0x7f363e0010e0) layout->[self][normal child]
          BODY RenderBody at (0,0) size 0x0 renderer (0x7f363e0017f0) layout box ((nil)) node (0x7f363e001230) layout->[self][normal child]
            RenderBlock at (0,0) size 0x0 renderer (0x7f363e007070) layout box ((nil)) layout->[self][normal child]
[parent]----->RUBY RenderInline renderer (0x7f363e005d20) layout box ((nil)) node (0x7f363e004620) continuation->(0x7f363e007250) layout->[self][normal child]
                RenderInline renderer (0x7f363e005dc0) layout box ((nil)) layout->[self][normal child]
                  #text RenderText renderer (0x7f363e005e60) layout box ((nil)) node (0x7f363e004700) length->(1) "\n" layout->[self]
                  #text RenderText renderer (0x7f363e005ed0) layout box ((nil)) node (0x7f363e004760) length->(1) "\n" layout->[self]
                  TIME RenderInline renderer (0x7f363e006b30) layout box ((nil)) node (0x7f363e004900) layout->[self][normal child]
                    #text RenderText renderer (0x7f363e006ac0) layout box ((nil)) node (0x7f363e0047c0) length->(1) "\n" layout->[self]
                  #text RenderText renderer (0x7f363e0060f0) layout box ((nil)) node (0x7f363e004a50) length->(1) "\n" layout->[self]
                  RenderInline renderer (0x7f363e006bd0) layout box ((nil)) layout->[self][normal child]
                    #text RenderText renderer (0x7f363e006c70) layout box ((nil)) node (0x7f363e004ab0) length->(1) "\n" layout->[self]
                  #text RenderText renderer (0x7f363e0061d0) layout box ((nil)) node (0x7f363e004c60) length->(1) "\n" layout->[self]
                  DATA RenderInline renderer (0x7f363e006d50) layout box ((nil)) node (0x7f363e004d20) continuation->(0x7f363e006f80) layout->[self][normal child]
                    #text RenderText renderer (0x7f363e006ce0) layout box ((nil)) node (0x7f363e004cc0) length->(1) "\n" layout->[self]
                  #text RenderText renderer (0x7f363e0063f0) layout box ((nil)) node (0x7f363e005010) length->(1) "\n" layout->[self]
            RenderBlock at (0,0) size 0x0 renderer (0x7f363e006f80) layout box ((nil)) continuation->(0x7f363e006df0) layout->[self][normal child]
              H3 RenderBlock at (0,0) size 0x0 renderer (0x7f363e006e90) layout box ((nil)) node (0x7f363e004e00) layout->[self]
            RenderBlock at (0,0) size 0x0 renderer (0x7f363e007160) layout box ((nil)) layout->[self][normal child]
              RUBY RenderInline renderer (0x7f363e007250) layout box ((nil)) node (0x7f363e004620) continuation->(0x7f363e006820) layout->[self][normal child]
                DATA RenderInline renderer (0x7f363e006df0) layout box ((nil)) node (0x7f363e004d20) layout->[self]
              RUBY RenderInline renderer (0x7f363e006820) layout box ((nil)) node (0x7f363e004620) layout->[self][normal child]
                RenderInline renderer (0x7f363e0068c0) layout box ((nil)) layout->[self][normal child]
[beforeChild]-->#text RenderText renderer (0x7f363e006a50) layout box ((nil)) node (0x7f363e0050d0) length->(1) "\n" layout->[self]

This is happening when creating a renderer for the RT element, here is the DOM tree:


BODY	0x7f363e001230 (renderer 0x7f363e0017f0) 
	#text	0x7f363e0045c0 "\n\n"
	RUBY	0x7f363e004620 (renderer 0x7f363e005d20) 
		#text	0x7f363e004700 "\n"
		RT	0x7f363e004820 (renderer (nil))  CLASS=class1
			#text	0x7f363e004760 "\n"
			TIME	0x7f363e004900 (renderer 0x7f363e006b30) 
				#text	0x7f363e0047c0 "\n"
			#text	0x7f363e004a50 "\n"
		RP	0x7f363e004b10 (renderer (nil))  CLASS=class1
			#text	0x7f363e004ab0 "\n"
		#text	0x7f363e004c60 "\n"
		DATA	0x7f363e004d20 (renderer 0x7f363e006d50) 
			#text	0x7f363e004cc0 "\n"
			H3	0x7f363e004e00 (renderer 0x7f363e006e90) 
				#text	0x7f363e004f50 "\n"
			#text	0x7f363e004fb0 "\n\n"
		#text	0x7f363e005010 "\n"
		RT	0x7f363e004890 (renderer 0x7f363e007390) 
			#text	0x7f363e005070 "\n"
		#text	0x7f363e0050d0 "\n"

[Frédéric Wang (:fredw)]

*** This bug has been marked as a duplicate of bug 268770 ***