Created attachment 224202 [details] Hover over the second region to trigger a crash There are cases when the hit-testing code asserts when hovering a region. This happens because we call borderBoxRectInRegion for a box with a region range that doesn't contain the target region. A good fix would be to make hit-testing rejection first based on the range of the box. It doesn't make sense to have a hit on a box in a region where that box doesn't actually appear.
This problem also happens for existing test LayoutTests/fast/regions/scrollable-paragraph-unsplittable.html
Created attachment 230665 [details] Patch
Comment on attachment 230665 [details] Patch r=me
Comment on attachment 230665 [details] Patch Clearing flags on attachment: 230665 Committed r168263: <http://trac.webkit.org/changeset/168263>
All reviewed patches have been landed. Closing bug.