Created attachment 236019 [details] Test case The failing test case: <style> * { width: 4em; height: 229px; display: table-caption; } head { -webkit-flow-from: bolder; } </style> Backtrace: ASSERTION FAILED: !region->needsLayout() || region->isRenderRegionSet() ../../Source/WebCore/rendering/RenderFlowThread.cpp(333) : virtual void WebCore::RenderFlowThread::updateLogicalWidth() Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fff97334700 (LWP 21655)] 0x00007ffff30191c8 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329 329 *(int *)(uintptr_t)0xbbadbeef = 0; #0 0x00007ffff30191c8 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329 #1 0x00007ffff3e075f8 in WebCore::RenderFlowThread::updateLogicalWidth (this=0x8f0b80) at ../../Source/WebCore/rendering/RenderFlowThread.cpp:333 #2 0x00007ffff3e06993 in WebCore::RenderFlowThread::validateRegions (this=0x8f0b80) at ../../Source/WebCore/rendering/RenderFlowThread.cpp:177 #3 0x00007ffff3e06ad8 in WebCore::RenderFlowThread::layout (this=0x8f0b80) at ../../Source/WebCore/rendering/RenderFlowThread.cpp:198 #4 0x00007ffff3eb6c86 in WebCore::RenderNamedFlowThread::layout (this=0x8f0b80) at ../../Source/WebCore/rendering/RenderNamedFlowThread.cpp:413 #5 0x00007ffff3d1ddd7 in WebCore::RenderElement::layoutIfNeeded (this=0x8f0b80) at ../../Source/WebCore/rendering/RenderElement.h:102 #6 0x00007ffff3d1cc63 in WebCore::FlowThreadController::layoutRenderNamedFlowThreads (this=0x81e1f0) at ../../Source/WebCore/rendering/FlowThreadController.cpp:99 #7 0x00007ffff3f28ad1 in WebCore::RenderView::layoutContent (this=0xa104a0, state=...) at ../../Source/WebCore/rendering/RenderView.cpp:234 #8 0x00007ffff3f29166 in WebCore::RenderView::layout (this=0xa104a0) at ../../Source/WebCore/rendering/RenderView.cpp:357 #9 0x00007ffff3acf1f4 in WebCore::FrameView::layout (this=0xa0de80, allowSubtree=true) at ../../Source/WebCore/page/FrameView.cpp:1282 #10 0x00007ffff3ad2617 in WebCore::FrameView::visibleContentsResized (this=0xa0de80) at ../../Source/WebCore/page/FrameView.cpp:2258 #11 0x00007ffff3b81a3b in WebCore::ScrollView::updateScrollbars (this=0xa0de80, desiredOffset=...) at ../../Source/WebCore/platform/ScrollView.cpp:656 #12 0x00007ffff3b80425 in WebCore::ScrollView::setContentsSize (this=0xa0de80, newSize=...) at ../../Source/WebCore/platform/ScrollView.cpp:385 #13 0x00007ffff3accff0 in WebCore::FrameView::setContentsSize (this=0xa0de80, size=...) at ../../Source/WebCore/page/FrameView.cpp:540 #14 0x00007ffff3acd20a in WebCore::FrameView::adjustViewSize (this=0xa0de80) at ../../Source/WebCore/page/FrameView.cpp:570 #15 0x00007ffff3acf2fd in WebCore::FrameView::layout (this=0xa0de80, allowSubtree=true) at ../../Source/WebCore/page/FrameView.cpp:1313 #16 0x00007ffff353f72f in WebCore::Document::implicitClose (this=0x8c07b0) at ../../Source/WebCore/dom/Document.cpp:2438 #17 0x00007ffff399e745 in WebCore::FrameLoader::checkCallImplicitClose (this=0x98d7e8) at ../../Source/WebCore/loader/FrameLoader.cpp:898 #18 0x00007ffff399e4f0 in WebCore::FrameLoader::checkCompleted (this=0x98d7e8) at ../../Source/WebCore/loader/FrameLoader.cpp:844 #19 0x00007ffff399e278 in WebCore::FrameLoader::finishedParsing (this=0x98d7e8) at ../../Source/WebCore/loader/FrameLoader.cpp:764 #20 0x00007ffff35470db in WebCore::Document::finishedParsing (this=0x8c07b0) at ../../Source/WebCore/dom/Document.cpp:4519 #21 0x00007ffff383a805 in WebCore::HTMLConstructionSite::finishedParsing (this=0x8444b8) at ../../Source/WebCore/html/parser/HTMLConstructionSite.cpp:395 #22 0x00007ffff3874c57 in WebCore::HTMLTreeBuilder::finished (this=0x8444a0) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2997 #23 0x00007ffff38423a0 in WebCore::HTMLDocumentParser::end (this=0x8441a0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:451 #24 0x00007ffff384248b in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd (this=0x8441a0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:462 #25 0x00007ffff3840ff9 in WebCore::HTMLDocumentParser::prepareToStopParsing (this=0x8441a0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:165 #26 0x00007ffff38424ce in WebCore::HTMLDocumentParser::attemptToEnd (this=0x8441a0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:474 #27 0x00007ffff3842585 in WebCore::HTMLDocumentParser::finish (this=0x8441a0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:502 #28 0x00007ffff3991445 in WebCore::DocumentWriter::end (this=0x84d670) at ../../Source/WebCore/loader/DocumentWriter.cpp:250 #29 0x00007ffff397e49b in WebCore::DocumentLoader::finishedLoading (this=0x84d5d0, finishTime=0) at ../../Source/WebCore/loader/DocumentLoader.cpp:441 #30 0x00007ffff397e204 in WebCore::DocumentLoader::notifyFinished (this=0x84d5d0, resource=0x87a580) at ../../Source/WebCore/loader/DocumentLoader.cpp:375 #31 0x00007ffff3a24a99 in WebCore::CachedResource::checkNotify (this=0x87a580) at ../../Source/WebCore/loader/cache/CachedResource.cpp:334 #32 0x00007ffff3a24b80 in WebCore::CachedResource::finishLoading (this=0x87a580) at ../../Source/WebCore/loader/cache/CachedResource.cpp:350 #33 0x00007ffff3a21b3a in WebCore::CachedRawResource::finishLoading (this=0x87a580, data=0x97c5c0) at ../../Source/WebCore/loader/cache/CachedRawResource.cpp:98 #34 0x00007ffff39d87da in WebCore::SubresourceLoader::didFinishLoading (this=0x87aae0, finishTime=0) at ../../Source/WebCore/loader/SubresourceLoader.cpp:310 #35 0x00007ffff39d4cc7 in WebCore::ResourceLoader::didFinishLoading (this=0x87aae0, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:517 #36 0x00007ffff4297429 in WebCore::readCallback (asyncResult=0x8439d0, data=0x80b520) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1302 #37 0x00007fffec1d82ea in async_ready_callback_wrapper (source_object=0x98cb30, res=0x8439d0, user_data=0x80b520) at ginputstream.c:519 #38 0x00007fffec1f7ceb in g_task_return_now (task=0x8439d0) at gtask.c:1108 #39 0x00007fffec1f7d09 in complete_in_idle_cb (task=0x8439d0) at gtask.c:1117 #40 0x00007fffeb44e2e6 in g_main_dispatch (context=0x677bb0) at gmain.c:3065 #41 g_main_context_dispatch (context=context@entry=0x677bb0) at gmain.c:3641 #42 0x00007fffeb44e638 in g_main_context_iterate (context=0x677bb0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3712 #43 0x00007fffeb44ea3a in g_main_loop_run (loop=0x913eb0) at gmain.c:3906 #44 0x00007ffff306a156 in WTF::RunLoop::run () at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:59 #45 0x00007ffff2fa35e0 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffda58) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61 #46 0x00007ffff2fa3445 in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffda58) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:73 #47 0x000000000040085d in main (argc=2, argv=0x7fffffffda58) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:32
This issue no longer occurs under GuardMalloc or ASAN as of r204037. If you believe there is still a bug, please reopen this issue with a revised test case.