Bug 98026 – Assertion triggered in WebCore::RenderTextControlSingleLine::layout when running fast/dom/shadow/input-with-validation.html

• Component: WebCore Misc.
• Status: RESOLVED FIXED

When running fast/dom/shadow/input-with-validation.html  in content shell:

echo file://$(pwd)/LayoutTests/fast/dom/shadow/input-with-validation.html | out/Debug/content_shell --dump-render-tree --no-sandbox

I trip the following assertion (or crash in a release build)

ASSERTION FAILED: innerTextRenderer
../../third_party/WebKit/Source/WebCore/rendering/RenderTextControlSingleLine.cpp(111) : virtual void WebCore::RenderTextControlSingleLine::layout()
[1146:1146:1001/152510:26967082264:ERROR:process_util_posix.cc(144)] Received signal 11
        base::debug::StackTrace::StackTrace() [0x50cf7e]
        base::(anonymous namespace)::StackDumpSignalHandler() [0x524df4]
        0x7f3a878784c0
        WebCore::RenderTextControlSingleLine::layout() [0x3b220f2]
        WebCore::RenderObject::layoutIfNeeded() [0x1e044a6]
        WebCore::RenderBlock::layoutInlineChildren() [0x1f7a9b8]
        WebCore::RenderBlock::layoutBlock() [0x1f24452]
        WebCore::RenderBlock::layout() [0x1f23475]
        WebCore::RenderBlock::layoutBlockChild() [0x1f2e492]
        WebCore::RenderBlock::layoutBlockChildren() [0x1f2680e]
        WebCore::RenderBlock::layoutBlock() [0x1f24472]
        WebCore::RenderBlock::layout() [0x1f23475]
        WebCore::RenderBlock::layoutBlockChild() [0x1f2e492]
        WebCore::RenderBlock::layoutBlockChildren() [0x1f2680e]
        WebCore::RenderBlock::layoutBlock() [0x1f24472]
        WebCore::RenderBlock::layout() [0x1f23475]
        WebCore::RenderBlock::layoutBlockChild() [0x1f2e492]
        WebCore::RenderBlock::layoutBlockChildren() [0x1f2680e]
        WebCore::RenderBlock::layoutBlock() [0x1f24472]
        WebCore::RenderBlock::layout() [0x1f23475]
        WebCore::RenderView::layout() [0x1e81291]
        WebCore::FrameView::layout() [0x29755ae]
        WebCore::Document::updateLayout() [0x302d538]
        WebCore::Document::updateLayoutIgnorePendingStylesheets() [0x302d60f]
        WebCore::HTMLFormElement::validateInteractively() [0x2d68ff5]
        WebCore::HTMLFormElement::prepareForSubmission() [0x2d68bb1]
        WebCore::SubmitInputType::handleDOMActivateEvent() [0x2de62a0]
        WebCore::HTMLInputElement::defaultEventHandler() [0x2d7a6d8]
        WebCore::EventDispatcher::dispatchEventPostProcess() [0x313c2d3]
        WebCore::EventDispatcher::dispatchEvent() [0x313b189]
        WebCore::EventDispatchMediator::dispatchEvent() [0x3139334]
        WebCore::EventDispatcher::dispatchEvent() [0x313a0a6]
        WebCore::ScopedEventQueue::dispatchEvent() [0x30fed2c]
        WebCore::ScopedEventQueue::enqueueEventDispatchMediator() [0x30fec51]
        WebCore::EventDispatcher::dispatchScopedEvent() [0x313a942]
        WebCore::Node::dispatchScopedEventDispatchMediator() [0x30d297d]
        WebCore::Node::dispatchScopedEvent() [0x30d292a]
        WebCore::Node::dispatchDOMActivateEvent() [0x30d3023]
        WebCore::Node::defaultEventHandler() [0x30d3942]
        WebCore::HTMLTextFormControlElement::defaultEventHandler() [0x2dc48ca]
        WebCore::HTMLInputElement::defaultEventHandler() [0x2d7aaff]
        WebCore::EventDispatcher::dispatchEventPostProcess() [0x313c2d3]
        WebCore::EventDispatcher::dispatchEvent() [0x313b189]
        WebCore::EventDispatcher::dispatchSimulatedClick() [0x313acd5]
        WebCore::Node::dispatchSimulatedClick() [0x30d3353]
        WebCore::HTMLElement::click() [0x2d61dde]
        WebCore::HTMLElementV8Internal::clickCallback() [0x35bc607]
        v8::internal::HandleApiCallHelper<>() [0x169afb5]
        v8::internal::Builtin_Impl_HandleApiCall() [0x169ab93]
        v8::internal::Builtin_HandleApiCall() [0x169475c]
        0x1def40b0618e

chromium issue is https://code.google.com/p/chromium/issues/detail?id=153282

Dimitri, any idea what's going on here? innerTextRenderer is a shadow DOM thing, isn't it?

[Dimitri Glazkov (Google)]

Kent-san, can you take a look?

[Dominic Cooney]

Nom nom nom.

[Dominic Cooney]

This should be fixed by revision 145239.