RESOLVED WORKSFORME 117406
ASSERTION FAILED: !((*it)->m_originatingLine) || (*it)->m_originatingLine->renderer() == this in WebCore::RenderBlock::deleteLineBoxTree 
https://bugs.webkit.org/show_bug.cgi?id=117406
Summary ASSERTION FAILED: !((*it)->m_originatingLine) || (*it)->m_originatingLine->re...
Renata Hodovan
Reported 2013-06-10 06:01:57 PDT
The following test fails the above assertion: <html> <applet code="org/w3c/domts/DOMTSApplet.class"> <object></object> <iframe seamless="0"></iframe> <comment> <embed log style="float: left;"> </comment> </applet> <input autofocus="0"> <body alink="#"> </html> Backtrace: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff574cc01 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:339 339 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff574cc01 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:339 #1 0x00007ffff488bd91 in WebCore::RenderBlock::deleteLineBoxTree (this=0x8ea378) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1003 #2 0x00007ffff488c877 in WebCore::RenderBlock::collapseAnonymousBoxChild (parent=0x7d29f8, child=0x8ea378) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1169 #3 0x00007ffff488ce7a in WebCore::RenderBlock::removeChild (this=0x7d29f8, oldChild=0x8ea938) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1283 #4 0x00007ffff49c215b in WebCore::RenderObject::remove (this=0x8ea938) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderObject.h:959 #5 0x00007ffff49e6e95 in WebCore::RenderObject::willBeDestroyed (this=0x8ea938) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderObject.cpp:2456 #6 0x00007ffff49bae43 in WebCore::RenderLayerModelObject::willBeDestroyed (this=0x8ea938) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderLayerModelObject.cpp:89 #7 0x00007ffff4909cc6 in WebCore::RenderBoxModelObject::willBeDestroyed (this=0x8ea938) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBoxModelObject.cpp:377 #8 0x00007ffff48ec7f8 in WebCore::RenderBox::willBeDestroyed (this=0x8ea938) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBox.cpp:169 #9 0x00007ffff4889538 in WebCore::RenderBlock::willBeDestroyed (this=0x8ea938) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:307 #10 0x00007ffff49e770f in WebCore::RenderObject::destroy (this=0x8ea938) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderObject.cpp:2616 #11 0x00007ffff488d25b in WebCore::RenderBlock::removeChild (this=0x8ea938, oldChild=0x8e20d8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1324 #12 0x00007ffff49c215b in WebCore::RenderObject::remove (this=0x8e20d8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderObject.h:959 #13 0x00007ffff49e6e95 in WebCore::RenderObject::willBeDestroyed (this=0x8e20d8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderObject.cpp:2456 #14 0x00007ffff49bae43 in WebCore::RenderLayerModelObject::willBeDestroyed (this=0x8e20d8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderLayerModelObject.cpp:89 #15 0x00007ffff4909cc6 in WebCore::RenderBoxModelObject::willBeDestroyed (this=0x8e20d8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBoxModelObject.cpp:377 #16 0x00007ffff48ec7f8 in WebCore::RenderBox::willBeDestroyed (this=0x8e20d8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBox.cpp:169 #17 0x00007ffff49f3f9f in WebCore::RenderReplaced::willBeDestroyed (this=0x8e20d8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderReplaced.cpp:68 #18 0x00007ffff4a49590 in WebCore::RenderWidget::willBeDestroyed (this=0x8e20d8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderWidget.cpp:113 #19 0x00007ffff4a495bd in WebCore::RenderWidget::destroy (this=0x8e20d8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderWidget.cpp:118 #20 0x00007ffff49e76e7 in WebCore::RenderObject::destroyAndCleanupAnonymousWrappers (this=0x8e20d8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderObject.cpp:2609 #21 0x00007ffff42c08a9 in WebCore::Node::detach (this=0x8e5d80) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Node.cpp:1027 #22 0x00007ffff4213c0e in WebCore::ContainerNode::detach (this=0x8e5d80) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/ContainerNode.cpp:800 #23 0x00007ffff427d1cb in WebCore::Element::detach (this=0x8e5d80) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Element.cpp:1480 #24 0x00007ffff420ffdb in WebCore::ContainerNode::detachChildren (this=0x750e10) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/ContainerNode.h:214 #25 0x00007ffff4213bf6 in WebCore::ContainerNode::detach (this=0x750e10) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/ContainerNode.cpp:798 #26 0x00007ffff427d1cb in WebCore::Element::detach (this=0x750e10) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Element.cpp:1480 #27 0x00007ffff443080f in WebCore::HTMLPlugInElement::detach (this=0x750e10) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/HTMLPlugInElement.cpp:113 #28 0x00007ffff4432192 in WebCore::HTMLPlugInImageElement::detach (this=0x750e10) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/HTMLPlugInImageElement.cpp:263 #29 0x00007ffff4275cbd in WebCore::Node::reattach (this=0x750e10) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Node.h:813 #30 0x00007ffff4431fd2 in WebCore::HTMLPlugInImageElement::willRecalcStyle (this=0x750e10) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/HTMLPlugInImageElement.cpp:233 #31 0x00007ffff427d5d6 in WebCore::Element::recalcStyle (this=0x750e10, change=WebCore::Node::Force) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Element.cpp:1534 #32 0x00007ffff427dbbd in WebCore::Element::recalcStyle (this=0x7872c0, change=WebCore::Node::Force) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Element.cpp:1623 #33 0x00007ffff427dbbd in WebCore::Element::recalcStyle (this=0x890c30, change=WebCore::Node::NoChange) ---Type <return> to continue, or q <return> to quit--- at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Element.cpp:1623 #34 0x00007ffff4225409 in WebCore::Document::recalcStyle (this=0x8b0990, change=WebCore::Node::NoChange) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:1839 #35 0x00007ffff42256ba in WebCore::Document::updateStyleIfNeeded (this=0x8b0990) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:1882 #36 0x00007ffff422e66f in WebCore::Document::finishedParsing (this=0x8b0990) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:4430 #37 0x00007ffff447c859 in WebCore::HTMLConstructionSite::finishedParsing (this=0x8af998) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLConstructionSite.cpp:344 #38 0x00007ffff44ae167 in WebCore::HTMLTreeBuilder::finished (this=0x8af980) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2923 #39 0x00007ffff4483dd2 in WebCore::HTMLDocumentParser::end (this=0x7874e0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:756 #40 0x00007ffff4483ebd in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd (this=0x7874e0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:767 #41 0x00007ffff4482af8 in WebCore::HTMLDocumentParser::prepareToStopParsing (this=0x7874e0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:211 #42 0x00007ffff4483f02 in WebCore::HTMLDocumentParser::attemptToEnd (this=0x7874e0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:779 #43 0x00007ffff4483fbb in WebCore::HTMLDocumentParser::finish (this=0x7874e0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:828 #44 0x00007ffff4616285 in WebCore::DocumentWriter::end (this=0x7e74c0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentWriter.cpp:248 #45 0x00007ffff4608e5a in WebCore::DocumentLoader::finishedLoading (this=0x7e7420, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentLoader.cpp:402 #46 0x00007ffff4608bc8 in WebCore::DocumentLoader::notifyFinished (this=0x7e7420, resource=0x721640) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentLoader.cpp:344 #47 0x00007ffff45f00f8 in WebCore::CachedResource::checkNotify (this=0x721640) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedResource.cpp:362 #48 0x00007ffff45f0152 in WebCore::CachedResource::data (this=0x721640, allDataReceived=true) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedResource.cpp:371 #49 0x00007ffff45ec927 in WebCore::CachedRawResource::data (this=0x721640, data=..., allDataReceived=true) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedRawResource.cpp:71 #50 0x00007ffff46526be in WebCore::SubresourceLoader::didFinishLoading (this=0x720db0, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/SubresourceLoader.cpp:282 #51 0x00007ffff4649093 in WebCore::ResourceLoader::didFinishLoading (this=0x720db0, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/ResourceLoader.cpp:493 #52 0x00007ffff4ae67f2 in WebCore::QNetworkReplyHandler::finish (this=0x719fd0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp:516 #53 0x00007ffff4ae5506 in WebCore::QNetworkReplyHandlerCallQueue::flush (this=0x71a008) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp:250 #54 0x00007ffff4ae5256 in WebCore::QNetworkReplyHandlerCallQueue::unlock (this=0x71a008) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp:230 #55 0x00007ffff4ae559f in WebCore::QueueLocker::~QueueLocker (this=0x7fffffffcae0, __in_chrg=<optimized out>) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp:258 #56 0x00007ffff4ae6094 in WebCore::QNetworkReplyWrapper::emitMetaDataChanged (this=0x818bc0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp:395 #57 0x00007ffff4ae5e40 in WebCore::QNetworkReplyWrapper::receiveSniffedMIMEType (this=0x818bc0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp:359 #58 0x00007ffff4ae8b0a in WebCore::QNetworkReplyWrapper::qt_static_metacall (_o=0x818bc0, _c=QMetaObject::InvokeMetaMethod, _id=3, _a=0x7fffffffcc60) at .moc/release-shared/moc_QNetworkReplyHandler.cpp:178 #59 0x00007ffff22795cb in QMetaObject::activate(QObject*, int, int, void**) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #60 0x00007ffff5316fc9 in QtMIMETypeSniffer::finished (this=0x88e230) at .moc/release-shared/moc_QtMIMETypeSniffer.cpp:131 #61 0x00007ffff4ae4596 in QtMIMETypeSniffer::trySniffing (this=0x88e230) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QtMIMETypeSniffer.cpp:65 ---Type <return> to continue, or q <return> to quit--- #62 0x00007ffff5316e2c in QtMIMETypeSniffer::qt_static_metacall (_o=0x88e230, _c=QMetaObject::InvokeMetaMethod, _id=1, _a=0x7fffffffce60) at .moc/release-shared/moc_QtMIMETypeSniffer.cpp:76 #63 0x00007ffff22795cb in QMetaObject::activate(QObject*, int, int, void**) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #64 0x00007ffff2cc5f81 in ?? () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Network.so.5 #65 0x00007ffff2d3fa4d in ?? () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Network.so.5 #66 0x00007ffff227a84e in QObject::event(QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #67 0x00007ffff30c0dbc in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Widgets.so.5 #68 0x00007ffff30c4075 in QApplication::notify(QObject*, QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Widgets.so.5 #69 0x00007ffff2254dbe in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #70 0x00007ffff2256a76 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #71 0x00007ffff229c333 in ?? () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #72 0x00007fffee3eaf05 in g_main_dispatch (context=0x6632f0) at /build/buildd/glib2.0-2.36.0/./glib/gmain.c:3054 #73 g_main_context_dispatch (context=context@entry=0x6632f0) at /build/buildd/glib2.0-2.36.0/./glib/gmain.c:3630 #74 0x00007fffee3eb248 in g_main_context_iterate (context=context@entry=0x6632f0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at /build/buildd/glib2.0-2.36.0/./glib/gmain.c:3701 #75 0x00007fffee3eb304 in g_main_context_iteration (context=0x6632f0, may_block=1) at /build/buildd/glib2.0-2.36.0/./glib/gmain.c:3762 #76 0x00007ffff229c4bc in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #77 0x00007ffff2253d3b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #78 0x00007ffff2257120 in QCoreApplication::exec() () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #79 0x0000000000421ba0 in launcherMain (app=...) at /home/reni/Data/REPOS/webkit_sec/Tools/QtTestBrowser/qttestbrowser.cpp:49 #80 0x0000000000423680 in main (argc=2, argv=0x7fffffffdc78) at /home/reni/Data/REPOS/webkit_sec/Tools/QtTestBrowser/qttestbrowser.cpp:318
Attachments
Add attachment proposed patch, testcase, etc.
Renata Hodovan
Comment 1 2014-09-08 04:22:30 PDT
I cannot reproduce the issue anymore.
Note You need to log in before you can comment on or make changes to this bug.