Bug 118269 - 100% repro assertion failure with testcase (m_repaintRect == renderer()->clippedOverflowRectForRepaint(renderer()->containerForRepaint()))
Summary: 100% repro assertion failure with testcase (m_repaintRect == renderer()->clip...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-07-01 17:46 PDT by Tim Horton
Modified: 2013-07-15 14:23 PDT (History)
4 users (show)

See Also:

Attachments
testcase (1.01 KB, text/html)
2013-07-01 17:47 PDT, Tim Horton 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Tim Horton 2013-07-01 17:46:53 PDT 
The attached testcase reproduces this assertion 100% of the time in DumpRenderTree, but (not yet) in Safari or Minibrowser. Similar to https://bugs.webkit.org/show_bug.cgi?id=103432.
Comment 1 Tim Horton 2013-07-01 17:47:19 PDT 
Created attachment 205847 [details]
testcase
Comment 2 Tim Horton 2013-07-01 18:28:36 PDT 
I’m going to land this testcase with https://bugs.webkit.org/show_bug.cgi?id=118176.
Comment 3 Allan Sandfeld Jensen 2013-07-03 06:01:40 PDT 
(In reply to comment #2)
> I’m going to land this testcase with https://bugs.webkit.org/show_bug.cgi?id=118176.

If the test-case is landed, does that mean the bug is fixed or is the test now partially failing?
Comment 4 Tim Horton 2013-07-03 09:34:02 PDT 
(In reply to comment #3)
> (In reply to comment #2)
> > I’m going to land this testcase with https://bugs.webkit.org/show_bug.cgi?id=118176.
> 
> If the test-case is landed, does that mean the bug is fixed or is the test now partially failing?

Partially skipped.
Comment 5 Tobias Netzel 2013-07-03 13:05:36 PDT 
I can reproduce this in both Safari 5.0.6 and Minibrowser WK1 by doing the following (you'll need a google account for this):

1. go to [http://code.google.com/p/chromium/issues/detail?id=244592]
2. log in
3. scroll down and click in the box to add new comment, so that the text input cursor is blinking in that box
4. scroll up

Here the crash upon scrolling is "enabled" by the fact of having clicked in the box. Clicking inside the box and then clicking outside of it doesn't "disable" it.
Comment 6 Alexey Proskuryakov 2013-07-15 12:57:31 PDT 
Looks like this causes heavily broken rendering in release mode.
Comment 7 Alexey Proskuryakov 2013-07-15 14:23:30 PDT 
To clarify, I know that this test renders wrong in release builds (tracked internally at Apple as <rdar://problem/14391146>), I don't know how closely that's related to the assertion failure.