The failing test: <html style="width: 100px;"> <head> <style type="text/css"> a {padding-right: 10.08em;min-height: 215px;width: 1px;float: left;} hr {font-size: 261px;border: 1px;} </style> </head> <pre> <a></a> <a></a> <a></a> <hr> <a></a> <a> Backtrace: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff56ece51 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:342 342 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff56ece51 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:342 #1 0x00007ffff485cc22 in WebCore::RenderBlock::ComputeFloatOffsetAdapter<(WebCore::RenderBlock::FloatingObject::Type)1>::collectIfNeeded ( this=0x7fffffff9520, interval=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:4472 #2 0x00007ffff4855e7c in WebCore::PODIntervalTree<int, WebCore::RenderBlock::FloatingObject*>::searchForOverlapsFrom<WebCore::RenderBlock::ComputeFloatOffsetAdapter<(WebCore::RenderBlock::FloatingObject::Type)1> > (this=0x8ec580, node=0x8efe80, adapter=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/PODIntervalTree.h:175 #3 0x00007ffff485013a in WebCore::PODIntervalTree<int, WebCore::RenderBlock::FloatingObject*>::allOverlapsWithAdapter<WebCore::RenderBlock::ComputeFloatOffsetAdapter<(WebCore::RenderBlock::FloatingObject::Type)1> > (this=0x8ec580, adapter=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/PODIntervalTree.h:125 #4 0x00007ffff4838757 in WebCore::RenderBlock::logicalLeftFloatOffsetForLine (this=0x8dffb8, logicalTop=..., fixedOffset=..., heightRemaining=0x0, logicalHeight=..., offsetMode=WebCore::RenderBlock::ShapeOutsideFloatShapeOffset) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:4523 #5 0x00007ffff481fc0e in WebCore::RenderBlock::logicalLeftOffsetForLine (this=0x8dffb8, logicalTop=..., fixedOffset=..., applyTextIndent=false, heightRemaining=0x0, logicalHeight=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.h:529 #6 0x00007ffff481f0fc in WebCore::RenderBlock::logicalLeftOffsetForLine (this=0x8dffb8, position=..., shouldIndentText=false, logicalHeight=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.h:205 #7 0x00007ffff486c4aa in WebCore::LineWidth::updateAvailableWidth (this=0x7fffffff9990, replacedHeight=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:178 #8 0x00007ffff486c1db in WebCore::LineWidth::LineWidth (this=0x7fffffff9990, block=0x8dffb8, isFirstLine=false, shouldIndentText=WebCore::DoNotIndentText) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:121 #9 0x00007ffff48797bd in WebCore::RenderBlock::LineBreaker::nextSegmentBreak (this=0x7fffffff9d40, resolver=..., lineInfo=..., renderTextInfo=..., lastFloatFromPreviousLine=0x8ec6c0, consecutiveHyphenatedLines=0, wordMeasurements=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:2926 #10 0x00007ffff4878ea4 in WebCore::RenderBlock::LineBreaker::nextLineBreak (this=0x7fffffff9d40, resolver=..., lineInfo=..., renderTextInfo=..., lastFloatFromPreviousLine=0x8ec6c0, consecutiveHyphenatedLines=0, wordMeasurements=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:2815 #11 0x00007ffff48738a4 in WebCore::RenderBlock::layoutRunsAndFloatsInRange (this=0x8dffb8, layoutState=..., resolver=..., cleanLineStart=..., cleanLineBidiStatus=..., consecutiveHyphenatedLines=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:1844 #12 0x00007ffff487239b in WebCore::RenderBlock::layoutRunsAndFloats (this=0x8dffb8, layoutState=..., hasInlineChild=true) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:1613 #13 0x00007ffff4875b1e in WebCore::RenderBlock::layoutInlineChildren (this=0x8dffb8, relayoutChildren=true, repaintLogicalTop=..., repaintLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:2189 #14 0x00007ffff48292af in WebCore::RenderBlock::layoutBlock (this=0x8dffb8, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1661 #15 0x00007ffff48285ff in WebCore::RenderBlock::layout (this=0x8dffb8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1426 #16 0x00007ffff482db99 in WebCore::RenderBlock::layoutBlockChild (this=0x8c5598, child=0x8dffb8, marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:2677 #17 0x00007ffff482d779 in WebCore::RenderBlock::layoutBlockChildren (this=0x8c5598, relayoutChildren=true, maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:2611 #18 0x00007ffff48292d0 in WebCore::RenderBlock::layoutBlock (this=0x8c5598, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1663 #19 0x00007ffff48285ff in WebCore::RenderBlock::layout (this=0x8c5598) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1426 #20 0x00007ffff482db99 in WebCore::RenderBlock::layoutBlockChild (this=0x823648, child=0x8c5598, marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:2677 #21 0x00007ffff482d779 in WebCore::RenderBlock::layoutBlockChildren (this=0x823648, relayoutChildren=true, maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:2611 #22 0x00007ffff48292d0 in WebCore::RenderBlock::layoutBlock (this=0x823648, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1663 #23 0x00007ffff48285ff in WebCore::RenderBlock::layout (this=0x823648) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1426 #24 0x00007ffff482db99 in WebCore::RenderBlock::layoutBlockChild (this=0x777828, child=0x823648, marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:2677 #25 0x00007ffff482d779 in WebCore::RenderBlock::layoutBlockChildren (this=0x777828, relayoutChildren=true, maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:2611 #26 0x00007ffff48292d0 in WebCore::RenderBlock::layoutBlock (this=0x777828, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1663 #27 0x00007ffff48285ff in WebCore::RenderBlock::layout (this=0x777828) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1426 ---Type <return> to continue, or q <return> to quit--- #28 0x00007ffff482db99 in WebCore::RenderBlock::layoutBlockChild (this=0x7315b8, child=0x777828, marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:2677 #29 0x00007ffff482d779 in WebCore::RenderBlock::layoutBlockChildren (this=0x7315b8, relayoutChildren=true, maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:2611 #30 0x00007ffff48292d0 in WebCore::RenderBlock::layoutBlock (this=0x7315b8, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1663 #31 0x00007ffff48285ff in WebCore::RenderBlock::layout (this=0x7315b8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1426 #32 0x00007ffff49e2f15 in WebCore::RenderView::layoutContent (this=0x7315b8, state=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderView.cpp:145 #33 0x00007ffff49e3cad in WebCore::RenderView::layout (this=0x7315b8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderView.cpp:328 #34 0x00007ffff4686af2 in WebCore::FrameView::layout (this=0x7a4530, allowSubtree=true) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/page/FrameView.cpp:1293 #35 0x00007ffff41b86c3 in WebCore::Document::implicitClose (this=0x8aeb60) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:2459 #36 0x00007ffff45bdccd in WebCore::FrameLoader::checkCallImplicitClose (this=0x7e1a40) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/FrameLoader.cpp:848 #37 0x00007ffff45bda3e in WebCore::FrameLoader::checkCompleted (this=0x7e1a40) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/FrameLoader.cpp:791 #38 0x00007ffff45bd773 in WebCore::FrameLoader::finishedParsing (this=0x7e1a40) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/FrameLoader.cpp:724 #39 0x00007ffff41bf6c1 in WebCore::Document::finishedParsing (this=0x8aeb60) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:4437 #40 0x00007ffff441387f in WebCore::HTMLConstructionSite::finishedParsing (this=0x7a7da8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLConstructionSite.cpp:352 #41 0x00007ffff4447fa7 in WebCore::HTMLTreeBuilder::finished (this=0x7a7d90) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2912 #42 0x00007ffff441afaa in WebCore::HTMLDocumentParser::end (this=0x7a62b0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:763 #43 0x00007ffff441b095 in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd (this=0x7a62b0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:774 #44 0x00007ffff4419c04 in WebCore::HTMLDocumentParser::prepareToStopParsing (this=0x7a62b0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:211 #45 0x00007ffff441b0da in WebCore::HTMLDocumentParser::attemptToEnd (this=0x7a62b0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:786 #46 0x00007ffff441b193 in WebCore::HTMLDocumentParser::finish (this=0x7a62b0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:835 #47 0x00007ffff45b54c9 in WebCore::DocumentWriter::end (this=0x694220) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentWriter.cpp:244 #48 0x00007ffff45a7f7f in WebCore::DocumentLoader::finishedLoading (this=0x694180, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentLoader.cpp:407 #49 0x00007ffff45a7ce8 in WebCore::DocumentLoader::notifyFinished (this=0x694180, resource=0x7d7df0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentLoader.cpp:344 #50 0x00007ffff458ef1c in WebCore::CachedResource::checkNotify (this=0x7d7df0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedResource.cpp:369 #51 0x00007ffff458eff2 in WebCore::CachedResource::finishLoading (this=0x7d7df0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedResource.cpp:385 #52 0x00007ffff458b744 in WebCore::CachedRawResource::finishLoading (this=0x7d7df0, data=0x76dd90) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedRawResource.cpp:94 #53 0x00007ffff45f1e11 in WebCore::SubresourceLoader::didFinishLoading (this=0x7d8740, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/SubresourceLoader.cpp:282 #54 0x00007ffff45e8737 in WebCore::ResourceLoader::didFinishLoading (this=0x7d8740, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/ResourceLoader.cpp:488 #55 0x00007ffff4aa1a1d in WebCore::QNetworkReplyHandler::finish (this=0x7d7c80) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp:516 #56 0x00007ffff4aa073c in WebCore::QNetworkReplyHandlerCallQueue::flush (this=0x7d7cb8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp:250 #57 0x00007ffff4aa0439 in WebCore::QNetworkReplyHandlerCallQueue::push (this=0x7d7cb8, method=(void (WebCore::QNetworkReplyHandler::*)(WebCore::QNetworkReplyHandler * const)) 0x7ffff4aa1862 <WebCore::QNetworkReplyHandler::finish()>) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp:216 #58 0x00007ffff4aa1386 in WebCore::QNetworkReplyWrapper::didReceiveFinished (this=0x77d340) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp:409 ---Type <return> to continue, or q <return> to quit--- #59 0x00007ffff4aa3d18 in WebCore::QNetworkReplyWrapper::qt_static_metacall (_o=0x77d340, _c=QMetaObject::InvokeMetaMethod, _id=1, _a=0x7fffffffce40) at .moc/release-shared/moc_QNetworkReplyHandler.cpp:176 #60 0x00007ffff22055cb in QMetaObject::activate(QObject*, int, int, void**) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #61 0x00007ffff220684e in QObject::event(QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #62 0x00007ffff304cdbc in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Widgets.so.5 #63 0x00007ffff3050075 in QApplication::notify(QObject*, QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Widgets.so.5 #64 0x00007ffff21e0dbe in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #65 0x00007ffff21e2a76 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #66 0x00007ffff2228333 in ?? () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #67 0x00007fffee3692d6 in g_main_dispatch (context=0x6632f0) at /build/buildd/glib2.0-2.37.6/./glib/gmain.c:3065 #68 g_main_context_dispatch (context=context@entry=0x6632f0) at /build/buildd/glib2.0-2.37.6/./glib/gmain.c:3641 #69 0x00007fffee369628 in g_main_context_iterate (context=context@entry=0x6632f0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at /build/buildd/glib2.0-2.37.6/./glib/gmain.c:3712 #70 0x00007fffee3696cc in g_main_context_iteration (context=0x6632f0, may_block=1) at /build/buildd/glib2.0-2.37.6/./glib/gmain.c:3773 #71 0x00007ffff22284bc in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #72 0x00007ffff21dfd3b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #73 0x00007ffff21e3120 in QCoreApplication::exec() () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #74 0x0000000000421ba0 in launcherMain (app=...) at /home/reni/Data/REPOS/webkit_sec/Tools/QtTestBrowser/qttestbrowser.cpp:49 #75 0x0000000000423680 in main (argc=2, argv=0x7fffffffdb18) at /home/reni/Data/REPOS/webkit_sec/Tools/QtTestBrowser/qttestbrowser.cpp:318
I cannot reproduce this issue with that test case. Did you do anything special with the build, or is it just a standard debug build?
(In reply to comment #1) > I cannot reproduce this issue with that test case. Did you do anything special with the build, or is it just a standard debug build? I've just now tried it on r154925 with a standard debug build and got the same result.
(In reply to comment #2) > (In reply to comment #1) > > I cannot reproduce this issue with that test case. Did you do anything special with the build, or is it just a standard debug build? > > I've just now tried it on r154925 with a standard debug build and got the same result. What port are you building? I still can't reproduce it on the mac port. Also, could you attach the test case as an attachment, just in case something weird happened with cut and paste?
Created attachment 210463 [details] Test case
(In reply to comment #3) > (In reply to comment #2) > > (In reply to comment #1) > > > I cannot reproduce this issue with that test case. Did you do anything special with the build, or is it just a standard debug build? > > > > I've just now tried it on r154925 with a standard debug build and got the same result. > > What port are you building? I still can't reproduce it on the mac port. Also, could you attach the test case as an attachment, just in case something weird happened with cut and paste? I'm sorry about the missing test case, but it's attached already. I experienced the crash with QtTestBrowser.
(In reply to comment #5) > (In reply to comment #3) > > (In reply to comment #2) > > > (In reply to comment #1) > > > > I cannot reproduce this issue with that test case. Did you do anything special with the build, or is it just a standard debug build? > > > > > > I've just now tried it on r154925 with a standard debug build and got the same result. > > > > What port are you building? I still can't reproduce it on the mac port. Also, could you attach the test case as an attachment, just in case something weird happened with cut and paste? > > I'm sorry about the missing test case, but it's attached already. I experienced the crash with QtTestBrowser. Thanks for the attached test case, that's quite different than the test case included in the bug description. Unfortunately, it still doesn't cause my mac debug build to crash. (I tried with run-safari, as well as with DumpRenderTree and with WebKitTestRunner) I'm stumped as to why this won't repro on the Mac port. So I guess in order to be able to debug this, I will have to get a Qt build up and running, perhaps even on Linux. I've put it on my queue, but if someone else who can repro wants to grab this and run with it, that would also be perfectly fine with me.
I'm constantly hitting this in debug builds (I'm running webkitgtk r159276). Just opening http://www.igalia.com makes the webprocess crash ASSERTION FAILED: rangesIntersect(m_renderer.pixelSnappedLogicalTopForFloat(floatingObject), m_renderer.pixelSnappedLogicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom) ../../Source/WebCore/rendering/FloatingObjects.cpp(463) : void WebCore::ComputeFloatOffsetAdapter<FloatTypeValue>::collectIfNeeded(const IntervalType&) [with WebCore::FloatingObject::Type FloatTypeValue = (WebCore::FloatingObject::Type)1u; WebCore::ComputeFloatOffsetAdapter<FloatTypeValue>::IntervalType = WebCore::PODInterval<WebCore::LayoutUnit, WebCore::FloatingObject*>] 1 0x7f624149365e /opt/WebKit/WebKitBuild/Debug/.libs/libjavascriptcoregtk-3.0.so.0(WTFCrash+0x1e) [0x7f624149365e] 2 0x7f623d1af414 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(+0x2428414) [0x7f623d1af414] 3 0x7f623d1ad116 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(+0x2426116) [0x7f623d1ad116] 4 0x7f623d1ad174 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(+0x2426174) [0x7f623d1ad174] 5 0x7f623d1ab50a /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(+0x242450a) [0x7f623d1ab50a] 6 0x7f623d1a9881 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15FloatingObjects36logicalLeftOffsetForPositioningFloatENS_10LayoutUnitES1_PS1_+0x51) [0x7f623d1a9881] 7 0x7f623d21fb89 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZNK7WebCore15RenderBlockFlow36logicalLeftOffsetForPositioningFloatENS_10LayoutUnitES1_bPS1_+0x8b) [0x7f623d21fb89] 8 0x7f623d21ffad /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZNK7WebCore15RenderBlockFlow30computeLogicalLocationForFloatEPKNS_14FloatingObjectENS_10LayoutUnitE+0x363) [0x7f623d21ffad] 9 0x7f623d2206f6 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow17positionNewFloatsEv+0x370) [0x7f623d2206f6] 10 0x7f623d239b15 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow22positionNewFloatOnLineEPNS_14FloatingObjectES2_RNS_8LineInfoERNS_9LineWidthE+0x3d) [0x7f623d239b15] 11 0x7f623d237111 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore11LineBreaker21skipLeadingWhitespaceERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERNS_8LineInfoEPNS_14FloatingObjectERNS_9LineWidthE+0x22d) [0x7f623d237111] 12 0x7f623d238c2d /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore11LineBreaker16nextSegmentBreakERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERNS_8LineInfoERNS_14RenderTextInfoEPNS_14FloatingObjectEjRN3WTF6VectorINS_15WordMeasurementELm64ENSC_15CrashOnOverflowEEE+0x14d) [0x7f623d238c2d] 13 0x7f623d237eab /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore11LineBreaker13nextLineBreakERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERNS_8LineInfoERNS_14RenderTextInfoEPNS_14FloatingObjectEjRN3WTF6VectorINS_15WordMeasurementELm64ENSC_15CrashOnOverflowEEE+0xb7) [0x7f623d237eab] 14 0x7f623d232cb7 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow26layoutRunsAndFloatsInRangeERNS_15LineLayoutStateERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERKS4_RKNS_10BidiStatusEj+0x553) [0x7f623d232cb7] 15 0x7f623d23164e /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow19layoutRunsAndFloatsERNS_15LineLayoutStateEb+0x40e) [0x7f623d23164e] 16 0x7f623d234c94 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow15layoutLineBoxesEbRNS_10LayoutUnitES2_+0x676) [0x7f623d234c94] 17 0x7f623d218ba8 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow20layoutInlineChildrenEbRNS_10LayoutUnitES2_+0xc8) [0x7f623d218ba8] 18 0x7f623d217ef9 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow11layoutBlockEbNS_10LayoutUnitE+0x401) [0x7f623d217ef9] 19 0x7f623d1e70ed /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore11RenderBlock6layoutEv+0x77) [0x7f623d1e70ed] 20 0x7f623d1b3b2b /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(+0x242cb2b) [0x7f623d1b3b2b] 21 0x7f623d21f5c0 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow20insertFloatingObjectERNS_9RenderBoxE+0x216) [0x7f623d21f5c0] 22 0x7f623d2370f0 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore11LineBreaker21skipLeadingWhitespaceERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERNS_8LineInfoEPNS_14FloatingObjectERNS_9LineWidthE+0x20c) [0x7f623d2370f0] 23 0x7f623d238c2d /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore11LineBreaker16nextSegmentBreakERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERNS_8LineInfoERNS_14RenderTextInfoEPNS_14FloatingObjectEjRN3WTF6VectorINS_15WordMeasurementELm64ENSC_15CrashOnOverflowEEE+0x14d) [0x7f623d238c2d] 24 0x7f623d237eab /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore11LineBreaker13nextLineBreakERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERNS_8LineInfoERNS_14RenderTextInfoEPNS_14FloatingObjectEjRN3WTF6VectorINS_15WordMeasurementELm64ENSC_15CrashOnOverflowEEE+0xb7) [0x7f623d237eab] 25 0x7f623d232cb7 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow26layoutRunsAndFloatsInRangeERNS_15LineLayoutStateERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERKS4_RKNS_10BidiStatusEj+0x553) [0x7f623d232cb7] 26 0x7f623d23164e /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow19layoutRunsAndFloatsERNS_15LineLayoutStateEb+0x40e) [0x7f623d23164e] 27 0x7f623d234c94 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow15layoutLineBoxesEbRNS_10LayoutUnitES2_+0x676) [0x7f623d234c94] 28 0x7f623d218ba8 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow20layoutInlineChildrenEbRNS_10LayoutUnitES2_+0xc8) [0x7f623d218ba8] 29 0x7f623d217ef9 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow11layoutBlockEbNS_10LayoutUnitE+0x401) [0x7f623d217ef9] 30 0x7f623d1e70ed /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore11RenderBlock6layoutEv+0x77) [0x7f623d1e70ed] 31 0x7f623d218f7b /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow16layoutBlockChildERNS_9RenderBoxERNS0_10MarginInfoERNS_10LayoutUnitES6_+0x3d1) [0x7f623d218f7b]
I'm pretty sure this is an entirely different problem than the one that this bug was originally filed for, since I'm pretty sure that's related to my patch in bug 124207. I've filed bug 124375 to track this new issue, and will upload a patch shortly. (In reply to comment #7) > I'm constantly hitting this in debug builds (I'm running webkitgtk r159276). Just opening http://www.igalia.com makes the webprocess crash > > ASSERTION FAILED: rangesIntersect(m_renderer.pixelSnappedLogicalTopForFloat(floatingObject), m_renderer.pixelSnappedLogicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom) > ../../Source/WebCore/rendering/FloatingObjects.cpp(463) : void WebCore::ComputeFloatOffsetAdapter<FloatTypeValue>::collectIfNeeded(const IntervalType&) [with WebCore::FloatingObject::Type FloatTypeValue = (WebCore::FloatingObject::Type)1u; WebCore::ComputeFloatOffsetAdapter<FloatTypeValue>::IntervalType = WebCore::PODInterval<WebCore::LayoutUnit, WebCore::FloatingObject*>] > 1 0x7f624149365e /opt/WebKit/WebKitBuild/Debug/.libs/libjavascriptcoregtk-3.0.so.0(WTFCrash+0x1e) [0x7f624149365e] > 2 0x7f623d1af414 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(+0x2428414) [0x7f623d1af414] > 3 0x7f623d1ad116 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(+0x2426116) [0x7f623d1ad116] > 4 0x7f623d1ad174 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(+0x2426174) [0x7f623d1ad174] > 5 0x7f623d1ab50a /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(+0x242450a) [0x7f623d1ab50a] > 6 0x7f623d1a9881 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15FloatingObjects36logicalLeftOffsetForPositioningFloatENS_10LayoutUnitES1_PS1_+0x51) [0x7f623d1a9881] > 7 0x7f623d21fb89 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZNK7WebCore15RenderBlockFlow36logicalLeftOffsetForPositioningFloatENS_10LayoutUnitES1_bPS1_+0x8b) [0x7f623d21fb89] > 8 0x7f623d21ffad /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZNK7WebCore15RenderBlockFlow30computeLogicalLocationForFloatEPKNS_14FloatingObjectENS_10LayoutUnitE+0x363) [0x7f623d21ffad] > 9 0x7f623d2206f6 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow17positionNewFloatsEv+0x370) [0x7f623d2206f6] > 10 0x7f623d239b15 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow22positionNewFloatOnLineEPNS_14FloatingObjectES2_RNS_8LineInfoERNS_9LineWidthE+0x3d) [0x7f623d239b15] > 11 0x7f623d237111 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore11LineBreaker21skipLeadingWhitespaceERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERNS_8LineInfoEPNS_14FloatingObjectERNS_9LineWidthE+0x22d) [0x7f623d237111] > 12 0x7f623d238c2d /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore11LineBreaker16nextSegmentBreakERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERNS_8LineInfoERNS_14RenderTextInfoEPNS_14FloatingObjectEjRN3WTF6VectorINS_15WordMeasurementELm64ENSC_15CrashOnOverflowEEE+0x14d) [0x7f623d238c2d] > 13 0x7f623d237eab /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore11LineBreaker13nextLineBreakERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERNS_8LineInfoERNS_14RenderTextInfoEPNS_14FloatingObjectEjRN3WTF6VectorINS_15WordMeasurementELm64ENSC_15CrashOnOverflowEEE+0xb7) [0x7f623d237eab] > 14 0x7f623d232cb7 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow26layoutRunsAndFloatsInRangeERNS_15LineLayoutStateERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERKS4_RKNS_10BidiStatusEj+0x553) [0x7f623d232cb7] > 15 0x7f623d23164e /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow19layoutRunsAndFloatsERNS_15LineLayoutStateEb+0x40e) [0x7f623d23164e] > 16 0x7f623d234c94 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow15layoutLineBoxesEbRNS_10LayoutUnitES2_+0x676) [0x7f623d234c94] > 17 0x7f623d218ba8 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow20layoutInlineChildrenEbRNS_10LayoutUnitES2_+0xc8) [0x7f623d218ba8] > 18 0x7f623d217ef9 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow11layoutBlockEbNS_10LayoutUnitE+0x401) [0x7f623d217ef9] > 19 0x7f623d1e70ed /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore11RenderBlock6layoutEv+0x77) [0x7f623d1e70ed] > 20 0x7f623d1b3b2b /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(+0x242cb2b) [0x7f623d1b3b2b] > 21 0x7f623d21f5c0 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow20insertFloatingObjectERNS_9RenderBoxE+0x216) [0x7f623d21f5c0] > 22 0x7f623d2370f0 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore11LineBreaker21skipLeadingWhitespaceERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERNS_8LineInfoEPNS_14FloatingObjectERNS_9LineWidthE+0x20c) [0x7f623d2370f0] > 23 0x7f623d238c2d /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore11LineBreaker16nextSegmentBreakERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERNS_8LineInfoERNS_14RenderTextInfoEPNS_14FloatingObjectEjRN3WTF6VectorINS_15WordMeasurementELm64ENSC_15CrashOnOverflowEEE+0x14d) [0x7f623d238c2d] > 24 0x7f623d237eab /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore11LineBreaker13nextLineBreakERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERNS_8LineInfoERNS_14RenderTextInfoEPNS_14FloatingObjectEjRN3WTF6VectorINS_15WordMeasurementELm64ENSC_15CrashOnOverflowEEE+0xb7) [0x7f623d237eab] > 25 0x7f623d232cb7 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow26layoutRunsAndFloatsInRangeERNS_15LineLayoutStateERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERKS4_RKNS_10BidiStatusEj+0x553) [0x7f623d232cb7] > 26 0x7f623d23164e /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow19layoutRunsAndFloatsERNS_15LineLayoutStateEb+0x40e) [0x7f623d23164e] > 27 0x7f623d234c94 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow15layoutLineBoxesEbRNS_10LayoutUnitES2_+0x676) [0x7f623d234c94] > 28 0x7f623d218ba8 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow20layoutInlineChildrenEbRNS_10LayoutUnitES2_+0xc8) [0x7f623d218ba8] > 29 0x7f623d217ef9 /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow11layoutBlockEbNS_10LayoutUnitE+0x401) [0x7f623d217ef9] > 30 0x7f623d1e70ed /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore11RenderBlock6layoutEv+0x77) [0x7f623d1e70ed] > 31 0x7f623d218f7b /opt/WebKit/WebKitBuild/Debug/.libs/libwebkit2gtk-3.0.so.25(_ZN7WebCore15RenderBlockFlow16layoutBlockChildERNS_9RenderBoxERNS0_10MarginInfoERNS_10LayoutUnitES6_+0x3d1) [0x7f623d218f7b]
Created attachment 264925 [details] Test Replacing the original test case since it doesn't reproduce the issue anymore.
I am unable to reproduce this problem under r204037 under GuardMalloc or ASAN. If you believe this is still an issue, could you please reopen the bug with a revised test case?