Bug 104533 – [GTK] fast/block/float/overhanging-tall-block.html is crashing on Debug builds

• Status: NEW
• Component: WebKitGTK

[Zan Dobersek]

It started crashing when the Debug bot was sick. Tough luck.
http://test-results.appspot.com/dashboards/flakiness_dashboard.html#group=%40ToT%20-%20webkit.org&tests=fast%2Fblock%2Ffloat%2Foverhanging-tall-block.html

Crash log for DumpRenderTree (pid 9024):
...
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/Programs/DumpR'.
Program terminated with signal 11, Segmentation fault.
#0  0x00007f9ce35cb6db in WebCore::RenderGeometryMap::mapToContainer (this=0x7fff93ea02e0, p=..., container=0x0) at ../../Source/WebCore/rendering/RenderGeometryMap.cpp:116
116	    ASSERT(roundedIntPoint(rendererMappedResult) == roundedIntPoint(result));

...

Thread 1 (Thread 0x7f9cd799d900 (LWP 9024)):
#0  0x00007f9ce35cb6db in WebCore::RenderGeometryMap::mapToContainer (this=0x7fff93ea02e0, p=..., container=0x0) at ../../Source/WebCore/rendering/RenderGeometryMap.cpp:116
#1  0x00007f9ce35fa526 in WebCore::RenderGeometryMap::absolutePoint (this=0x7fff93ea02e0, p=...) at ../../Source/WebCore/rendering/RenderGeometryMap.h:84
#2  0x00007f9ce35dee0c in WebCore::RenderLayer::updateLayerPositions (this=0x1137d468, geometryMap=0x7fff93ea02e0, flags=6) at ../../Source/WebCore/rendering/RenderLayer.cpp:355
#3  0x00007f9ce35df298 in WebCore::RenderLayer::updateLayerPositions (this=0x113761b8, geometryMap=0x7fff93ea02e0, flags=6) at ../../Source/WebCore/rendering/RenderLayer.cpp:416
#4  0x00007f9ce35df298 in WebCore::RenderLayer::updateLayerPositions (this=0x1136c6c8, geometryMap=0x7fff93ea02e0, flags=6) at ../../Source/WebCore/rendering/RenderLayer.cpp:416
#5  0x00007f9ce35ded2f in WebCore::RenderLayer::updateLayerPositionsAfterLayout (this=0x1136c6c8, rootLayer=0x1136c6c8, flags=6) at ../../Source/WebCore/rendering/RenderLayer.cpp:338
#6  0x00007f9ce342b506 in WebCore::FrameView::layout (this=0x11341050, allowSubtree=true) at ../../Source/WebCore/page/FrameView.cpp:1220
#7  0x00007f9ce2e6080d in WebCore::Document::updateLayout (this=0xdabd7d0) at ../../Source/WebCore/dom/Document.cpp:1923
#8  0x00007f9ce2e608df in WebCore::Document::updateLayoutIgnorePendingStylesheets (this=0xdabd7d0) at ../../Source/WebCore/dom/Document.cpp:1955
#9  0x00007f9ce2ec7908 in WebCore::Element::offsetTop (this=0x113777f0) at ../../Source/WebCore/dom/Element.cpp:438
#10 0x00007f9ce39448cb in WebCore::jsElementOffsetTop (exec=0x7f9c9432e058, slotBase=...) at DerivedSources/WebCore/JSElement.cpp:312
#11 0x00000000004a33d6 in JSC::PropertySlot::getValue (this=0x7fff93ea0a70, exec=0x7f9c9432e058, propertyName=...) at ../../Source/JavaScriptCore/runtime/PropertySlot.h:76
#12 0x00007f9ce6c550c7 in JSC::JSValue::get (this=0x7fff93ea0ac0, exec=0x7f9c9432e058, propertyName=..., slot=...) at ../../Source/JavaScriptCore/runtime/JSObject.h:1483
#13 0x00007f9ce6d5aa02 in JSC::LLInt::llint_slow_path_get_by_id (exec=0x7f9c9432e058, pc=0x1137f148) at ../../Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:915
#14 0x00007f9ce6d64244 in llint_op_get_by_id () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/.libs/libjavascriptcoregtk-3.0.so.0
#15 0x00007f9c9432e058 in ?? ()
#16 0x00007f9c9000fff0 in ?? ()
#17 0x00007fff93ea0bb0 in ?? ()
#18 0x00007f9ce6d0cad3 in JSC::JSStack::installTrapsAfterFrame (this=0x0, frame=0x0) at ../../Source/JavaScriptCore/interpreter/JSStackInlines.h:213
#19 0x00007f9ce6d0b840 in JSC::JITCode::execute (this=0x7f9c8e6751a0, stack=0x7f9c9000fff0, callFrame=0x7f9c9432e058, globalData=0x7f9c90006310) at ../../Source/JavaScriptCore/jit/JITCode.h:134
#20 0x00007f9ce6d0897a in JSC::Interpreter::execute (this=0x7f9c9000ffe0, program=0x7f9c8e675180, callFrame=0x7f9c942cd388, thisObj=0x7f9c942fffc0) at ../../Source/JavaScriptCore/interpreter/Interpreter.cpp:983
#21 0x00007f9ce6df62d4 in JSC::evaluate (exec=0x7f9c942cd388, source=..., thisValue=..., returnedException=0x7fff93ea2200) at ../../Source/JavaScriptCore/runtime/Completion.cpp:75
#22 0x00007f9ce2be8d6f in WebCore::JSMainThreadExecState::evaluate (exec=0x7f9c942cd388, source=..., thisValue=..., exception=0x7fff93ea2200) at ../../Source/WebCore/bindings/js/JSMainThreadExecState.h:77
#23 0x00007f9ce2c17c34 in WebCore::ScriptController::evaluateInWorld (this=0x22ac4e8, sourceCode=..., world=0x7f9c90015ad0) at ../../Source/WebCore/bindings/js/ScriptController.cpp:141
#24 0x00007f9ce2c17d4a in WebCore::ScriptController::evaluate (this=0x22ac4e8, sourceCode=...) at ../../Source/WebCore/bindings/js/ScriptController.cpp:158
#25 0x00007f9ce2f47859 in WebCore::ScriptElement::executeScript (this=0x1137da30, sourceCode=...) at ../../Source/WebCore/dom/ScriptElement.cpp:304
#26 0x00007f9ce2f47042 in WebCore::ScriptElement::prepareScript (this=0x1137da30, scriptStartPosition=..., supportLegacyTypes=WebCore::ScriptElement::DisallowLegacyTypeInTypeAttribute) at ../../Source/WebCore/dom/ScriptElement.cpp:242
#27 0x00007f9ce3161950 in WebCore::HTMLScriptRunner::runScript (this=0x1134bb70, script=0x1137d9c0, scriptStartPosition=...) at ../../Source/WebCore/html/parser/HTMLScriptRunner.cpp:290
#28 0x00007f9ce3160f89 in WebCore::HTMLScriptRunner::execute (this=0x1134bb70, scriptElement=..., scriptStartPosition=...) at ../../Source/WebCore/html/parser/HTMLScriptRunner.cpp:170
#29 0x00007f9ce31517ab in WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder (this=0x1136ca60) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:200
#30 0x00007f9ce315185d in WebCore::HTMLDocumentParser::canTakeNextToken (this=0x1136ca60, mode=WebCore::HTMLDocumentParser::AllowYield, session=...) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:217
#31 0x00007f9ce3151c70 in WebCore::HTMLDocumentParser::pumpTokenizer (this=0x1136ca60, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:254
#32 0x00007f9ce3151658 in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible (this=0x1136ca60, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:173
#33 0x00007f9ce3152214 in WebCore::HTMLDocumentParser::append (this=0x1136ca60, source=...) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:361
#34 0x00007f9ce2e53df9 in WebCore::DecodedDataDocumentParser::flush (this=0x1136ca60, writer=0x11307268) at ../../Source/WebCore/dom/DecodedDataDocumentParser.cpp:60
#35 0x00007f9ce3343ca1 in WebCore::DocumentWriter::end (this=0x11307268) at ../../Source/WebCore/loader/DocumentWriter.cpp:241
#36 0x00007f9ce33347d4 in WebCore::DocumentLoader::finishedLoading (this=0x113071c0) at ../../Source/WebCore/loader/DocumentLoader.cpp:301
#37 0x00007f9ce338250b in WebCore::MainResourceLoader::didFinishLoading (this=0x112f5eb0, finishTime=0) at ../../Source/WebCore/loader/MainResourceLoader.cpp:518
#38 0x00007f9ce338eb91 in WebCore::ResourceLoader::didFinishLoading (this=0x112f5eb0, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:453
#39 0x00007f9ce3cd1f0d in WebCore::readCallback (asyncResult=0xf83a800, data=0x1134d050) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1198
#40 0x00007f9ce1b75ad3 in async_ready_callback_wrapper () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgio-2.0.so.0
#41 0x00007f9ce1b90bc8 in g_simple_async_result_complete () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgio-2.0.so.0
#42 0x00007f9ce1b90d90 in complete_in_idle_cb_for_thread () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgio-2.0.so.0
#43 0x00007f9ce19c03e9 in g_idle_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#44 0x00007f9ce19bdc91 in g_main_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#45 0x00007f9ce19be956 in g_main_context_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#46 0x00007f9ce19beb39 in g_main_context_iterate () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#47 0x00007f9ce19bef69 in g_main_loop_run () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#48 0x00007f9ce20a5e22 in gtk_main () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgtk-3.so.0
#49 0x00000000004822b8 in runTest (inputLine=...) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:755
#50 0x00000000004819f6 in runTestingServerLoop () at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:545
#51 0x00000000004849f8 in main (argc=2, argv=0x7fff93ea36c8) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:1454