Bug 132117 - [CSS Regions] In some situations, flowing the body into a flow thread causes an assertion failure
Summary: [CSS Regions] In some situations, flowing the body into a flow thread causes ...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: CSS (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: AdobeTracked
Depends on:
Blocks: 57312
  Show dependency treegraph
 
Reported: 2014-04-24 01:55 PDT by Radu Stavila
Modified: 2014-04-24 01:56 PDT (History)
0 users

See Also:


Attachments
Test-case (1.49 KB, text/html)
2014-04-24 01:56 PDT, Radu Stavila
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Radu Stavila 2014-04-24 01:55:15 PDT
See attached test-case. 

OUTPUT:

ASSERTION FAILED: m_invalidRegionList.contains(renderNamedFlowFragment)
/Adobe/WebKit/Source/WebCore/rendering/RenderNamedFlowThread.cpp(257) : virtual void WebCore::RenderNamedFlowThread::removeRegionFromThread(WebCore::RenderRegion *)
1   0x108459d50 WTFCrash
2   0x10b49a625 WebCore::RenderNamedFlowThread::removeRegionFromThread(WebCore::RenderRegion*)
3   0x10b4bcf6f WebCore::RenderRegion::detachRegion()
4   0x10b496073 WebCore::RenderNamedFlowFragment::detachRegion()
5   0x10b4bd467 WebCore::RenderRegion::willBeRemovedFromTree()
6   0x10b3839d8 WebCore::RenderElement::removeChildInternal(WebCore::RenderObject&, WebCore::RenderElement::NotifyChildrenType)
7   0x10b3837b2 WebCore::RenderElement::removeChild(WebCore::RenderObject&)
8   0x10b2b6b93 WebCore::RenderBlock::removeChild(WebCore::RenderObject&)
9   0x10b306c1d WebCore::RenderBlockFlow::removeChild(WebCore::RenderObject&)
10  0x10b4aacf6 WebCore::RenderObject::removeFromParent()
11  0x10b4b40e6 WebCore::RenderObject::willBeDestroyed()
12  0x10b385570 WebCore::RenderElement::willBeDestroyed()
13  0x10b45e016 WebCore::RenderLayerModelObject::willBeDestroyed()
14  0x10b34d1f6 WebCore::RenderBoxModelObject::willBeDestroyed()
15  0x10b326d7a WebCore::RenderBox::willBeDestroyed()
16  0x10b2efafc WebCore::RenderBlockFlow::willBeDestroyed()
17  0x10b4b452d WebCore::RenderObject::destroy()
18  0x10b2efb4f WebCore::RenderBlockFlow::setRenderNamedFlowFragment(WebCore::RenderNamedFlowFragment*)
19  0x10b2ef95e WebCore::RenderBlockFlow::willBeDestroyed()
20  0x10b4b452d WebCore::RenderObject::destroy()
21  0x10b4b4502 WebCore::RenderObject::destroyAndCleanupAnonymousWrappers()
22  0x10b847f05 WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType)
23  0x10b849f7a WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType)
24  0x10b847ed9 WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType)
25  0x10b84a176 WebCore::Style::resolveLocal(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change)
26  0x10b847b0b WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change)
27  0x10b847d49 WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change)
28  0x10b8479b8 WebCore::Style::resolveTree(WebCore::Document&, WebCore::Style::Change)
29  0x10a160c86 WebCore::Document::recalcStyle(WebCore::Style::Change)
30  0x10a15d20f WebCore::Document::updateStyleIfNeeded()
31  0x10a16cf02 WebCore::Document::finishedParsing()
Comment 1 Radu Stavila 2014-04-24 01:56:51 PDT
Created attachment 230064 [details]
Test-case