|Summary:||Crash inside RenderObject::localToAbsolute below FrameView::layout|
|Component:||Layout and Rendering||Assignee:||Nobody <webkit-unassigned>|
|Severity:||Normal||CC:||bdakin, hyatt, jamesr, knorton, mitz|
|Version:||528+ (Nightly build)|
|OS:||OS X 10.5|
Description jaimeyap 2009-11-03 17:52:17 PST
Comment 1 Mark Rowe (bdash) 2009-11-03 20:19:44 PST
Comment 2 mitz 2009-11-05 14:49:20 PST
I can’t reproduce the crash with attachment 42439 [details] on Mac OS X with TOT and on Windows with a slightly older build.
Comment 3 jaimeyap 2009-11-05 15:19:47 PST
It still crashes for me at webkit r50535 which is pretty near ToT. It is pulling in jQuery 1.3.2 over the network. You should try again to see if you had a network hiccup of some sort.
Comment 4 jaimeyap 2009-11-05 15:29:50 PST
Confirmed to crash on the latest webkit nightly on Mac OSX. @mitz: What revision were you trying at? (I am building ToT now to test)
Comment 5 mitz 2009-11-06 00:17:23 PST
After several attempts, I managed to reproduce the crash in TOT.
Comment 6 mitz 2009-11-06 00:20:09 PST
Very similar to <rdar://problem/7094146>, which was fixed in <http://trac.webkit.org/changeset/49484>.
Comment 7 mitz 2009-11-06 17:51:58 PST
I have a simplified version of the test case that sometimes triggers the crash. When it happens, I can see that very early on the render tree enters an inconsistent state, where a renderer is marked dirty even though its container is not (and it’s not the subtree layout root). This is caused by RenderLayer::setStaticY() telling setChildNeedsLayout() not to mark parents.
Comment 9 mitz 2009-11-07 20:57:01 PST
Created attachment 42710 [details] Make setStaticY() not mark the object for layout
Comment 10 mitz 2009-11-08 09:33:47 PST
Fixed in <http://trac.webkit.org/projects/webkit/changeset/50623>.