118587 – ASSERTION FAILED: layoutState->m_renderer == this in WebCore::RenderBlock::offsetFromLogicalTopOfFirstPage

RESOLVED FIXED 118587

ASSERTION FAILED: layoutState->m_renderer == this in WebCore::RenderBlock::offsetFromLogicalTopOfFirstPage

https://bugs.webkit.org/show_bug.cgi?id=118587

Summary ASSERTION FAILED: layoutState->m_renderer == this in WebCore::RenderBlock::of...

Renata Hodovan

Reported 2013-07-12 01:28:08 PDT

The test causes the asserion: <html> <ul style="-webkit-flow-into: flow" ></ul> <body style="-webkit-writing-mode: vertical-rl;"></body> </html> The backtrace: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff577f390 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:339 339 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff577f390 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:339 #1 0x00007ffff4904dac in WebCore::RenderBlock::offsetFromLogicalTopOfFirstPage (this=0x768ec8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:7764 #2 0x00007ffff494fcda in WebCore::RenderBox::containingBlockLogicalWidthForPositioned (this=0x8aa798, containingBlock=0x768ec8, region=0x0, checkForPerpendicularWritingMode=false) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBox.cpp:2936 #3 0x00007ffff495030f in WebCore::RenderBox::containingBlockLogicalHeightForPositioned (this=0x8aa798, containingBlock=0x768ec8, checkForPerpendicularWritingMode=true) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBox.cpp:2981 #4 0x00007ffff494f495 in WebCore::RenderBox::availableLogicalHeightUsing (this=0x8aa798, h=..., heightType=WebCore::ExcludeMarginBorderPadding) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBox.cpp:2859 #5 0x00007ffff494f28c in WebCore::RenderBox::availableLogicalHeight (this=0x8aa798, heightType=WebCore::ExcludeMarginBorderPadding) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBox.cpp:2840 #6 0x00007ffff49491ac in WebCore::RenderBox::perpendicularContainingBlockLogicalHeight (this=0x8894e8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBox.cpp:1723 #7 0x00007ffff494b214 in WebCore::RenderBox::computeLogicalWidthInRegion (this=0x8894e8, computedValues=..., region=0x0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBox.cpp:2151 #8 0x00007ffff494aba4 in WebCore::RenderBox::updateLogicalWidth (this=0x8894e8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBox.cpp:2087 #9 0x00007ffff48e40b8 in WebCore::RenderBlock::updateLogicalWidthAndColumnWidth (this=0x8894e8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1551 #10 0x00007ffff48e4488 in WebCore::RenderBlock::layoutBlock (this=0x8894e8, relayoutChildren=false, pageLogicalHeight=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1603 #11 0x00007ffff48e3c35 in WebCore::RenderBlock::layout (this=0x8894e8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1428 #12 0x00007ffff48e8e32 in WebCore::RenderBlock::layoutBlockChild (this=0x8aa798, child=0x8894e8, marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:2666 #13 0x00007ffff48e8a54 in WebCore::RenderBlock::layoutBlockChildren (this=0x8aa798, relayoutChildren=false, maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:2601 #14 0x00007ffff48e47f1 in WebCore::RenderBlock::layoutBlock (this=0x8aa798, relayoutChildren=false, pageLogicalHeight=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1655 #15 0x00007ffff48e3c35 in WebCore::RenderBlock::layout (this=0x8aa798) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1428 #16 0x00007ffff499a3ec in WebCore::RenderFlowThread::layout (this=0x8aa798) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderFlowThread.cpp:214 #17 0x00007ffff48b08cb in WebCore::RenderObject::layoutIfNeeded (this=0x8aa798) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderObject.h:704 #18 0x00007ffff48b0fef in WebCore::FlowThreadController::layoutRenderNamedFlowThreads (this=0x8a39f0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/FlowThreadController.cpp:104 #19 0x00007ffff4a8ccd1 in WebCore::RenderView::layoutContent (this=0x768ec8, state=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderView.cpp:144 #20 0x00007ffff4a8d9c3 in WebCore::RenderView::layout (this=0x768ec8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderView.cpp:305 #21 0x00007ffff474d4f3 in WebCore::FrameView::layout (this=0x770790, allowSubtree=true) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/page/FrameView.cpp:1318 #22 0x00007ffff429518e in WebCore::Document::implicitClose (this=0x871860) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:2454 #23 0x00007ffff4689ec3 in WebCore::FrameLoader::checkCallImplicitClose (this=0x7ac248) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/FrameLoader.cpp:843 #24 0x00007ffff4689c2e in WebCore::FrameLoader::checkCompleted (this=0x7ac248) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/FrameLoader.cpp:786 #25 0x00007ffff468996c in WebCore::FrameLoader::finishedParsing (this=0x7ac248) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/FrameLoader.cpp:719 #26 0x00007ffff429c03b in WebCore::Document::finishedParsing (this=0x871860) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:4417 #27 0x00007ffff44e8dd3 in WebCore::HTMLConstructionSite::finishedParsing (this=0x7ae7b8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLConstructionSite.cpp:348 #28 0x00007ffff451a4bf in WebCore::HTMLTreeBuilder::finished (this=0x7ae7a0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2926 #29 0x00007ffff44f0386 in WebCore::HTMLDocumentParser::end (this=0x7666d0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:756 #30 0x00007ffff44f0473 in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd (this=0x7666d0) ---Type <return> to continue, or q <return> to quit--- at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:767 #31 0x00007ffff44ef0a6 in WebCore::HTMLDocumentParser::prepareToStopParsing (this=0x7666d0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:211 #32 0x00007ffff44f04b6 in WebCore::HTMLDocumentParser::attemptToEnd (this=0x7666d0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:779 #33 0x00007ffff44f056d in WebCore::HTMLDocumentParser::finish (this=0x7666d0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:828 #34 0x00007ffff46819b5 in WebCore::DocumentWriter::end (this=0x693380) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentWriter.cpp:248 #35 0x00007ffff467459e in WebCore::DocumentLoader::finishedLoading (this=0x6932e0, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentLoader.cpp:402 #36 0x00007ffff467430c in WebCore::DocumentLoader::notifyFinished (this=0x6932e0, resource=0x75c550) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentLoader.cpp:344 #37 0x00007ffff465b9d8 in WebCore::CachedResource::checkNotify (this=0x75c550) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedResource.cpp:369 #38 0x00007ffff465baae in WebCore::CachedResource::finishLoading (this=0x75c550) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedResource.cpp:385 #39 0x00007ffff46581be in WebCore::CachedRawResource::finishLoading (this=0x75c550, data=0x77ac60) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedRawResource.cpp:94 #40 0x00007ffff46bda4a in WebCore::SubresourceLoader::didFinishLoading (this=0x74e740, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/SubresourceLoader.cpp:282 #41 0x00007ffff46b43d7 in WebCore::ResourceLoader::didFinishLoading (this=0x74e740, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/ResourceLoader.cpp:488 #42 0x00007ffff4b4179c in WebCore::QNetworkReplyHandler::finish (this=0x7542a0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp:516 #43 0x00007ffff4b40462 in WebCore::QNetworkReplyHandlerCallQueue::flush (this=0x7542d8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp:250 #44 0x00007ffff4b4018a in WebCore::QNetworkReplyHandlerCallQueue::push (this=0x7542d8, method=(void (WebCore::QNetworkReplyHandler::*)(WebCore::QNetworkReplyHandler * const)) 0x7ffff4b415de <WebCore::QNetworkReplyHandler::finish()>) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp:216 #45 0x00007ffff4b410e8 in WebCore::QNetworkReplyWrapper::didReceiveFinished (this=0x75c3f0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp:409 #46 0x00007ffff4b43aaa in WebCore::QNetworkReplyWrapper::qt_static_metacall (_o=0x75c3f0, _c=QMetaObject::InvokeMetaMethod, _id=1, _a=0x7fffffffcf20) at .moc/release-shared/moc_QNetworkReplyHandler.cpp:176 #47 0x00007ffff231e5cb in QMetaObject::activate(QObject*, int, int, void**) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #48 0x00007ffff231f84e in QObject::event(QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #49 0x00007ffff3165dbc in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Widgets.so.5 #50 0x00007ffff3169075 in QApplication::notify(QObject*, QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Widgets.so.5 #51 0x00007ffff22f9dbe in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #52 0x00007ffff22fba76 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #53 0x00007ffff2341333 in ?? () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #54 0x00007fffee4840a6 in g_main_dispatch (context=0x6623e0) at /build/buildd/glib2.0-2.37.3/./glib/gmain.c:3058 #55 g_main_context_dispatch (context=context@entry=0x6623e0) at /build/buildd/glib2.0-2.37.3/./glib/gmain.c:3634 #56 0x00007fffee4843f8 in g_main_context_iterate (context=context@entry=0x6623e0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at /build/buildd/glib2.0-2.37.3/./glib/gmain.c:3705 #57 0x00007fffee48449c in g_main_context_iteration (context=0x6623e0, may_block=1) at /build/buildd/glib2.0-2.37.3/./glib/gmain.c:3766 #58 0x00007ffff23414bc in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #59 0x00007ffff22f8d3b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #60 0x00007ffff22fc120 in QCoreApplication::exec() () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #61 0x0000000000420f3c in launcherMain (app=...) at /home/reni/Data/REPOS/webkit_sec/Tools/QtTestBrowser/qttestbrowser.cpp:49 #62 0x0000000000422a1c in main (argc=2, argv=0x7fffffffdbf8) at /home/reni/Data/REPOS/webkit_sec/Tools/QtTestBrowser/qttestbrowser.cpp:318

Attachments
Test case (123 bytes, text/html) 2013-07-12 01:31 PDT, Renata Hodovan	no flags	Details
patch (3.89 KB, patch) 2013-07-16 09:26 PDT, Mihai Maerean	no flags	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Renata Hodovan

Comment 1 2013-07-12 01:31:26 PDT

Created attachment 206511 [details] Test case

Mihai Maerean

Comment 2 2013-07-16 09:26:32 PDT

Created attachment 206789 [details] patch

Dave Hyatt

Comment 3 2013-07-16 09:35:14 PDT

Comment on attachment 206789 [details] patch r=me

WebKit Commit Bot

Comment 4 2013-07-17 00:19:19 PDT

Comment on attachment 206789 [details] patch Clearing flags on attachment: 206789 Committed r152768: <http://trac.webkit.org/changeset/152768>

WebKit Commit Bot

Comment 5 2013-07-17 00:19:22 PDT

All reviewed patches have been landed. Closing bug.

Note You need to log in before you can comment on or make changes to this bug.

Status RESOLVED

Resolution FIXED

Priority P2

Severity Normal

Classification Unclassified

Version 528+ (Nightly build)

Hardware PC

OS Linux

Product WebKit

Component Layout and Rendering

Assignee

Mihai Maerean

Reported

2013-07-12 01:28 PDT

Modified

2013-07-17 00:19 PDT History

CC List

6 users Show

URL

Keywords

Depends on

Blocks

116980

Dependencies

tree graph