RESOLVED DUPLICATE of bug 108257 Bug 108452
ASSERT(clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRectsType]) in RenderLayer 
https://bugs.webkit.org/show_bug.cgi?id=108452
Summary ASSERT(clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRe...
Renata Hodovan
Reported 2013-01-31 03:10:48 PST
I've got the following assert during HTML fuzzing: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff44927b8 in WebCore::RenderLayer::updateClipRects (this=0x7c70d8, clipRectsContext=...) at /home/reni/WebKit-git/Source/WebCore/rendering/RenderLayer.cpp:4521 4521 ASSERT(clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRectsType]); The test: <html> <body style="-webkit-column-count: 2; -webkit-column-gap: 0"> <div style="overflow: scroll"> <div style="position: absolute;"></div> <div style="-webkit-box-reflect: below 2px"></div> </div> </body> </html>
Attachments
Add attachment proposed patch, testcase, etc.
Simon Fraser (smfr)
Comment 1 2013-01-31 09:09:48 PST
*** This bug has been marked as a duplicate of bug 108257 ***
Note You need to log in before you can comment on or make changes to this bug.