Summary: | Crash inside RenderObject::localToAbsolute below FrameView::layout | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | jaimeyap | ||||||
Component: | Layout and Rendering | Assignee: | Nobody <webkit-unassigned> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | bdakin, hyatt, jamesr, knorton, mitz | ||||||
Priority: | P2 | Keywords: | HasReduction, InRadar | ||||||
Version: | 528+ (Nightly build) | ||||||||
Hardware: | PC | ||||||||
OS: | OS X 10.5 | ||||||||
Attachments: |
|
Description
jaimeyap
2009-11-03 17:52:17 PST
I can’t reproduce the crash with attachment 42439 [details] on Mac OS X with TOT and on Windows with a slightly older build.
It still crashes for me at webkit r50535 which is pretty near ToT. It is pulling in jQuery 1.3.2 over the network. You should try again to see if you had a network hiccup of some sort. Confirmed to crash on the latest webkit nightly on Mac OSX. @mitz: What revision were you trying at? (I am building ToT now to test) After several attempts, I managed to reproduce the crash in TOT. Very similar to <rdar://problem/7094146>, which was fixed in <http://trac.webkit.org/changeset/49484>. I have a simplified version of the test case that sometimes triggers the crash. When it happens, I can see that very early on the render tree enters an inconsistent state, where a renderer is marked dirty even though its container is not (and it’s not the subtree layout root). This is caused by RenderLayer::setStaticY() telling setChildNeedsLayout() not to mark parents. Created attachment 42710 [details]
Make setStaticY() not mark the object for layout
|