Bug 123863 – Assertion failure end < m_runCount in WebCore::BidiRunList<WebCore::BidiRun>::reverseRuns

• Status: RESOLVED
• Resolution: FIXED
• Component: Text

[Ryosuke Niwa]

Merge https://chromium.googlesource.com/chromium/blink/+/cbaa92c763a37d89eeabd01658e522219299290c

ASSERTION FAILED: end < m_runCount
/Volumes/Data/webkit2/Source/WebCore/platform/text/BidiRunList.h(207) : void WebCore::BidiRunList<WebCore::BidiRun>::reverseRuns(unsigned int, unsigned int) [Run = WebCore::BidiRun]
1   0x1098fd4d0 WTFCrash
2   0x10c4fd9cf WebCore::BidiRunList<WebCore::BidiRun>::reverseRuns(unsigned int, unsigned int)
3   0x10c4fbb20 WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>::createBidiRunsForLine(WebCore::InlineIterator const&, WebCore::VisualDirectionOverride, bool)
4   0x10c4eb522 WebCore::constructBidiRunsForSegment(WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>&, WebCore::BidiRunList<WebCore::BidiRun>&, WebCore::InlineIterator const&, WebCore::VisualDirectionOverride, bool)
5   0x10c4e4163 WebCore::constructBidiRunsForLine(WebCore::RenderBlockFlow const*, WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>&, WebCore::BidiRunList<WebCore::BidiRun>&, WebCore::InlineIterator const&, WebCore::VisualDirectionOverride, bool)
6   0x10c4e0dcf WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange(WebCore::LineLayoutState&, WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>&, WebCore::InlineIterator const&, WebCore::BidiStatus const&, unsigned int)
7   0x10c4df4a9 WebCore::RenderBlockFlow::layoutRunsAndFloats(WebCore::LineLayoutState&, bool)
8   0x10c4e4db1 WebCore::RenderBlockFlow::layoutLineBoxes(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
9   0x10ccd70c1 WebCore::RenderBlockFlow::layoutInlineChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
10  0x10ccd6335 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
11  0x10c4a543d WebCore::RenderBlock::layout()
12  0x10ccd96e8 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
13  0x10ccd7341 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)
14  0x10ccd6358 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
15  0x10c4a543d WebCore::RenderBlock::layout()
16  0x10ccd96e8 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
17  0x10ccd7341 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)
18  0x10ccd6358 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
19  0x10c4a543d WebCore::RenderBlock::layout()
20  0x10ccd96e8 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
21  0x10ccd7341 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)
22  0x10ccd6358 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
23  0x10c4a543d WebCore::RenderBlock::layout()
24  0x10c762a5d WebCore::RenderView::layoutContent(WebCore::LayoutState const&)
25  0x10c763c07 WebCore::RenderView::layout()
26  0x10b8fe0ae WebCore::FrameView::layout(bool)
27  0x10b63e11c WebCore::Document::implicitClose()
28  0x10b8d1c0b WebCore::FrameLoader::checkCallImplicitClose()
29  0x10b8d1886 WebCore::FrameLoader::checkCompleted()
30  0x10b8d01a8 WebCore::FrameLoader::finishedParsing()
31  0x10b648c9b WebCore::Document::finishedParsing()

[Ryosuke Niwa]

Created attachment 216123 [details]
Merges the fix

[Radar WebKit Bug Importer]

<rdar://problem/15401213>

[Ryosuke Niwa]

Created attachment 216124 [details]
Merges the fix

[Andreas Kling]

Comment on attachment 216123 [details]
Merges the fix

r=me

[Ryosuke Niwa]

Comment on attachment 216123 [details]
Merges the fix

Clearing flags on attachment: 216123

Committed r158729: <http://trac.webkit.org/changeset/158729>

[Ryosuke Niwa]

All reviewed patches have been landed.  Closing bug.