Created attachment 211100 [details] Repro The assertion mainAxisExtent - mainAxisBorderAndPaddingExtentForChild(child) >= 0 in RenderFlexibleBox::preferredMainAxisContentExtentForChild(WebCore::RenderBox *, bool) can fail in certain cases. A simple repro case is attached. <rdar://problem/14933505>
I tried this in a debug build of blink, but blink doesn't hit this assert. This is probably because blink doesn't support MathML.
(In reply to comment #1) > I tried this in a debug build of blink, but blink doesn't hit this assert. This is probably because blink doesn't support MathML. I can reproduce this issue (or at least the same assertion fail) on the TotT Blink with a different test case. The issue with the test case is reported here: https://code.google.com/p/chromium/issues/detail?id=335121.
Created attachment 264921 [details] Repro 2 An even shorter repro is: <math><menclose>
I didn't not try the testcase, but I'm making this depends on bug 153991 where MathML will have its own layout, independent from flexbox.
I no longer have this assert after the MathML refactoring (probably fixed by bug 155019 and 153918). I'm still waiting bug 153991 before closing this bug so that we are sure that code will never be executed with MathML.
Fixed by http://trac.webkit.org/changeset/202934, since MathML no longer execute RenderFlexibleBox code.