Created attachment 236356 [details] Test case The failing test: <!DOCTYPE html> <a> <blockquote> <embed src="http://example.com"></embed> <a></a> </blockquote> </a> <style> * { position:relative; } </style> Backtrace: ASSERTION FAILED: block && block->isAnonymousBlock() ../../Source/WebCore/rendering/RenderInline.cpp(198) : virtual void WebCore::RenderInline::styleDidChange(WebCore::StyleDifference, const WebCore::RenderStyle*) Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fff97537700 (LWP 2466)] 0x000000000044c8a9 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329 329 *(int *)(uintptr_t)0xbbadbeef = 0; #0 0x000000000044c8a9 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329 #1 0x00007ffff3fa9252 in WebCore::RenderInline::styleDidChange (this=0x8ad1d0, diff=WebCore::StyleDifferenceLayout, oldStyle=0x8ef460) at ../../Source/WebCore/rendering/RenderInline.cpp:198 #2 0x00007ffff3f5ed5c in WebCore::RenderElement::setStyle (this=0x8ad1d0, style=...) at ../../Source/WebCore/rendering/RenderElement.cpp:430 #3 0x00007ffff418dcf6 in WebCore::RenderElement::setAnimatableStyle (this=0x8ad1d0, style=...) at ../../Source/WebCore/rendering/RenderElement.h:250 #4 0x00007ffff418c8b0 in WebCore::Style::resolveLocal (current=..., renderingParentNode=..., renderTreePosition=..., inheritedChange=WebCore::Style::NoInherit) at ../../Source/WebCore/style/StyleResolveTree.cpp:737 #5 0x00007ffff418ce2f in WebCore::Style::resolveTree (current=..., renderingParentNode=..., renderTreePosition=..., change=WebCore::Style::NoInherit) at ../../Source/WebCore/style/StyleResolveTree.cpp:887 #6 0x00007ffff418d070 in WebCore::Style::resolveTree (current=..., renderingParentNode=..., renderTreePosition=..., change=WebCore::Style::NoInherit) at ../../Source/WebCore/style/StyleResolveTree.cpp:922 #7 0x00007ffff418d070 in WebCore::Style::resolveTree (current=..., renderingParentNode=..., renderTreePosition=..., change=WebCore::Style::NoInherit) at ../../Source/WebCore/style/StyleResolveTree.cpp:922 #8 0x00007ffff418d32b in WebCore::Style::resolveTree (document=..., change=WebCore::Style::NoChange) at ../../Source/WebCore/style/StyleResolveTree.cpp:964 #9 0x00007ffff36d00e0 in WebCore::Document::recalcStyle (this=0x862730, change=WebCore::Style::NoChange) at ../../Source/WebCore/dom/Document.cpp:1750 #10 0x00007ffff36d0391 in WebCore::Document::updateStyleIfNeeded (this=0x862730) at ../../Source/WebCore/dom/Document.cpp:1795 #11 0x00007ffff36d9cd5 in WebCore::Document::finishedParsing (this=0x862730) at ../../Source/WebCore/dom/Document.cpp:4514 #12 0x00007ffff39cf05f in WebCore::HTMLConstructionSite::finishedParsing (this=0x83c538) at ../../Source/WebCore/html/parser/HTMLConstructionSite.cpp:395 #13 0x00007ffff3a094d1 in WebCore::HTMLTreeBuilder::finished (this=0x83c520) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2997 #14 0x00007ffff39d6bfa in WebCore::HTMLDocumentParser::end (this=0x8ac800) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:451 #15 0x00007ffff39d6ce5 in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd (this=0x8ac800) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:462 #16 0x00007ffff39d5853 in WebCore::HTMLDocumentParser::prepareToStopParsing (this=0x8ac800) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:165 #17 0x00007ffff39d6d28 in WebCore::HTMLDocumentParser::attemptToEnd (this=0x8ac800) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:474 #18 0x00007ffff39d6ddf in WebCore::HTMLDocumentParser::finish (this=0x8ac800) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:502 #19 0x00007ffff3b1e063 in WebCore::DocumentWriter::end (this=0x8a4a80) at ../../Source/WebCore/loader/DocumentWriter.cpp:250 #20 0x00007ffff3b0b0b7 in WebCore::DocumentLoader::finishedLoading (this=0x8a49e0, finishTime=0) at ../../Source/WebCore/loader/DocumentLoader.cpp:441 #21 0x00007ffff3b0ae20 in WebCore::DocumentLoader::notifyFinished (this=0x8a49e0, resource=0x8d7b00) at ../../Source/WebCore/loader/DocumentLoader.cpp:375 #22 0x00007ffff3bb199b in WebCore::CachedResource::checkNotify (this=0x8d7b00) at ../../Source/WebCore/loader/cache/CachedResource.cpp:334 #23 0x00007ffff3bb1a82 in WebCore::CachedResource::finishLoading (this=0x8d7b00) at ../../Source/WebCore/loader/cache/CachedResource.cpp:350 #24 0x00007ffff3baea21 in WebCore::CachedRawResource::finishLoading (this=0x8d7b00, data=0x849f50) at ../../Source/WebCore/loader/cache/CachedRawResource.cpp:101 #25 0x00007ffff3b654ae in WebCore::SubresourceLoader::didFinishLoading (this=0x8d8060, finishTime=0) at ../../Source/WebCore/loader/SubresourceLoader.cpp:310 #26 0x00007ffff3b6199b in WebCore::ResourceLoader::didFinishLoading (this=0x8d8060, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:518 #27 0x00007ffff441bf5b in WebCore::readCallback (asyncResult=0x8ac1f0, data=0x8a32a0) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1302 #28 0x00007fffee5732ea in async_ready_callback_wrapper (source_object=0xa59b30, res=0x8ac1f0, user_data=0x8a32a0) at ginputstream.c:519 #29 0x00007fffee592ceb in g_task_return_now (task=0x8ac1f0) at gtask.c:1108 #30 0x00007fffee592d09 in complete_in_idle_cb (task=0x8ac1f0) at gtask.c:1117 #31 0x00007fffee8c22e6 in g_main_dispatch (context=0x744bb0) at gmain.c:3065 #32 g_main_context_dispatch (context=context@entry=0x744bb0) at gmain.c:3641 #33 0x00007fffee8c2638 in g_main_context_iterate (context=0x744bb0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3712 #34 0x00007fffee8c2a3a in g_main_loop_run (loop=0x7d6c40) at gmain.c:3906 #35 0x00007ffff4a67850 in WTF::RunLoop::run () at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:59 #36 0x00007ffff321d850 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffda58) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61 #37 0x00007ffff321d6b5 in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffda58) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:73 #38 0x000000000044c28d in main (argc=2, argv=0x7fffffffda58) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:32
This issue no longer occurs under GuardMalloc or ASAN as of r204037. If you believe there is still a bug, please reopen this issue with a revised test case.