Created attachment 242809 [details] Test case Run this test with debug WK: <!DOCTYPE html> <style> * { display:block; text-emphasis-style:filled triangle; } </style> <ruby>a <rt> <code></code> </rt> </ruby> Backtrace: ASSERTION FAILED: childrenInline() ../../Source/WebCore/rendering/RenderBlockFlow.cpp(3452) : virtual bool WebCore::RenderBlockFlow::hasLines() const Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fff98927700 (LWP 10673)] 0x00007fffedbca36f in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 321 *(int *)(uintptr_t)0xbbadbeef = 0; #0 0x00007fffedbca36f in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 #1 0x00007ffff396ddaf in WebCore::RenderBlockFlow::hasLines (this=0x552bc0) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:3452 #2 0x00007ffff3925104 in WebCore::InlineTextBox::emphasisMarkExistsAndIsAbove (this=0x7cabf0, style=..., above=@0x7fffffff958d: true) at ../../Source/WebCore/rendering/InlineTextBox.cpp:463 #3 0x00007ffff39185e4 in WebCore::InlineFlowBox::placeBoxesInBlockDirection (this=0x639210, top=..., maxHeight=..., maxAscent=15, strictMode=true, lineTop=..., lineBottom=..., setLineTop=@0x7fffffff984c: false, lineTopIncludingMargins=..., lineBottomIncludingMargins=..., hasAnnotationsBefore=@0x7fffffff984d: false, hasAnnotationsAfter=@0x7fffffff984e: false, baselineType=WebCore::AlphabeticBaseline) at ../../Source/WebCore/rendering/InlineFlowBox.cpp:693 #4 0x00007ffff3b4b737 in WebCore::RootInlineBox::alignBoxesInBlockDirection (this=0x639210, heightOfBlock=..., textBoxDataMap=..., verticalPositionCache=...) at ../../Source/WebCore/rendering/RootInlineBox.cpp:291 #5 0x00007ffff397c377 in WebCore::RenderBlockFlow::computeBlockDirectionPositionsForLine (this=0x54e970, lineBox=0x639210, firstRun=0x6c0580, textBoxDataMap=..., verticalPositionCache=...) at ../../Source/WebCore/rendering/RenderBlockLineLayout.cpp:785 #6 0x00007ffff397cccb in WebCore::RenderBlockFlow::createLineBoxesFromBidiRuns (this=0x54e970, bidiLevel=0, bidiRuns=..., end=..., lineInfo=..., verticalPositionCache=..., trailingSpaceRun=0x0, wordMeasurements=...) at ../../Source/WebCore/rendering/RenderBlockLineLayout.cpp:996 #7 0x00007ffff397dc06 in WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange (this=0x54e970, layoutState=..., resolver=..., cleanLineStart=..., cleanLineBidiStatus=..., consecutiveHyphenatedLines=0) at ../../Source/WebCore/rendering/RenderBlockLineLayout.cpp:1185 #8 0x00007ffff397d277 in WebCore::RenderBlockFlow::layoutRunsAndFloats (this=0x54e970, layoutState=..., hasInlineChild=true) at ../../Source/WebCore/rendering/RenderBlockLineLayout.cpp:1085 #9 0x00007ffff397faee in WebCore::RenderBlockFlow::layoutLineBoxes (this=0x54e970, relayoutChildren=true, repaintLogicalTop=..., repaintLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockLineLayout.cpp:1502 #10 0x00007ffff395f687 in WebCore::RenderBlockFlow::layoutInlineChildren (this=0x54e970, relayoutChildren=true, repaintLogicalTop=..., repaintLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:640 #11 0x00007ffff395e98a in WebCore::RenderBlockFlow::layoutBlock (this=0x54e970, relayoutChildren=true, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:471 #12 0x00007ffff393456f in WebCore::RenderBlock::layout (this=0x54e970) at ../../Source/WebCore/rendering/RenderBlock.cpp:931 #13 0x00007ffff395fa64 in WebCore::RenderBlockFlow::layoutBlockChild (this=0x7e6700, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:699 #14 0x00007ffff395f581 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x7e6700, relayoutChildren=true, maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:620 #15 0x00007ffff395e9ae in WebCore::RenderBlockFlow::layoutBlock (this=0x7e6700, relayoutChildren=true, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:473 #16 0x00007ffff393456f in WebCore::RenderBlock::layout (this=0x7e6700) at ../../Source/WebCore/rendering/RenderBlock.cpp:931 #17 0x00007ffff3ada376 in WebCore::RenderRubyRun::layout (this=0x7e6700) at ../../Source/WebCore/rendering/RenderRubyRun.cpp:233 #18 0x00007ffff3900519 in WebCore::RenderElement::layoutIfNeeded (this=0x7e6700) at ../../Source/WebCore/rendering/RenderElement.h:119 #19 0x00007ffff397faac in WebCore::RenderBlockFlow::layoutLineBoxes (this=0x5dece0, relayoutChildren=true, repaintLogicalTop=..., repaintLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockLineLayout.cpp:1500 #20 0x00007ffff395f687 in WebCore::RenderBlockFlow::layoutInlineChildren (this=0x5dece0, relayoutChildren=true, repaintLogicalTop=..., repaintLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:640 #21 0x00007ffff395e98a in WebCore::RenderBlockFlow::layoutBlock (this=0x5dece0, relayoutChildren=true, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:471 #22 0x00007ffff393456f in WebCore::RenderBlock::layout (this=0x5dece0) at ../../Source/WebCore/rendering/RenderBlock.cpp:931 #23 0x00007ffff395fa64 in WebCore::RenderBlockFlow::layoutBlockChild (this=0x7e83c0, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:699 #24 0x00007ffff395f581 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x7e83c0, relayoutChildren=true, maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:620 #25 0x00007ffff395e9ae in WebCore::RenderBlockFlow::layoutBlock (this=0x7e83c0, relayoutChildren=true, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:473 #26 0x00007ffff393456f in WebCore::RenderBlock::layout (this=0x7e83c0) at ../../Source/WebCore/rendering/RenderBlock.cpp:931 #27 0x00007ffff395fa64 in WebCore::RenderBlockFlow::layoutBlockChild (this=0x4751e0, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:699 #28 0x00007ffff395f581 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x4751e0, relayoutChildren=true, maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:620 #29 0x00007ffff395e9ae in WebCore::RenderBlockFlow::layoutBlock (this=0x4751e0, relayoutChildren=true, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:473 #30 0x00007ffff393456f in WebCore::RenderBlock::layout (this=0x4751e0) at ../../Source/WebCore/rendering/RenderBlock.cpp:931 #31 0x00007ffff395fa64 in WebCore::RenderBlockFlow::layoutBlockChild (this=0x6b98b0, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:699 #32 0x00007ffff395f581 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x6b98b0, relayoutChildren=true, maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:620 #33 0x00007ffff395e9ae in WebCore::RenderBlockFlow::layoutBlock (this=0x6b98b0, relayoutChildren=true, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:473 #34 0x00007ffff393456f in WebCore::RenderBlock::layout (this=0x6b98b0) at ../../Source/WebCore/rendering/RenderBlock.cpp:931 #35 0x00007ffff3b2e84d in WebCore::RenderView::layoutContent (this=0x6b98b0, state=...) at ../../Source/WebCore/rendering/RenderView.cpp:232 #36 0x00007ffff3b2ef1d in WebCore::RenderView::layout (this=0x6b98b0) at ../../Source/WebCore/rendering/RenderView.cpp:357 #37 0x00007ffff369c389 in WebCore::FrameView::layout (this=0x829210, allowSubtree=true) at ../../Source/WebCore/page/FrameView.cpp:1313 #38 0x00007ffff3067dc5 in WebCore::Document::implicitClose (this=0x6bbe60) at ../../Source/WebCore/dom/Document.cpp:2486 #39 0x00007ffff3547a0d in WebCore::FrameLoader::checkCallImplicitClose (this=0x74e2e8) at ../../Source/WebCore/loader/FrameLoader.cpp:898 #40 0x00007ffff3547779 in WebCore::FrameLoader::checkCompleted (this=0x74e2e8) at ../../Source/WebCore/loader/FrameLoader.cpp:844 #41 0x00007ffff35474e2 in WebCore::FrameLoader::finishedParsing (this=0x74e2e8) at ../../Source/WebCore/loader/FrameLoader.cpp:764 #42 0x00007ffff3070c99 in WebCore::Document::finishedParsing (this=0x6bbe60) at ../../Source/WebCore/dom/Document.cpp:4615 #43 0x00007ffff33c6039 in WebCore::HTMLConstructionSite::finishedParsing (this=0x82a1c8) at ../../Source/WebCore/html/parser/HTMLConstructionSite.cpp:395 #44 0x00007ffff3403a33 in WebCore::HTMLTreeBuilder::finished (this=0x82a1b0) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:3009 #45 0x00007ffff33ced4e in WebCore::HTMLDocumentParser::end (this=0x6bd520) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:439 #46 0x00007ffff33cee39 in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd (this=0x6bd520) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:450 #47 0x00007ffff33cd8e7 in WebCore::HTMLDocumentParser::prepareToStopParsing (this=0x6bd520) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:165 #48 0x00007ffff33cee7c in WebCore::HTMLDocumentParser::attemptToEnd (this=0x6bd520) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:462 #49 0x00007ffff33cef33 in WebCore::HTMLDocumentParser::finish (this=0x6bd520) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:490 #50 0x00007ffff3538b7f in WebCore::DocumentWriter::end (this=0x6ee020) at ../../Source/WebCore/loader/DocumentWriter.cpp:246 #51 0x00007ffff35248db in WebCore::DocumentLoader::finishedLoading (this=0x6edf80, finishTime=0) at ../../Source/WebCore/loader/DocumentLoader.cpp:440 #52 0x00007ffff3524644 in WebCore::DocumentLoader::notifyFinished (this=0x6edf80, resource=0x6153c0) at ../../Source/WebCore/loader/DocumentLoader.cpp:374 #53 0x00007ffff35d5370 in WebCore::CachedResource::checkNotify (this=0x6153c0) at ../../Source/WebCore/loader/cache/CachedResource.cpp:293 #54 0x00007ffff35d546e in WebCore::CachedResource::finishLoading (this=0x6153c0) at ../../Source/WebCore/loader/cache/CachedResource.cpp:309 #55 0x00007ffff35d1b63 in WebCore::CachedRawResource::finishLoading (this=0x6153c0, data=0x6bd000) at ../../Source/WebCore/loader/cache/CachedRawResource.cpp:104 #56 0x00007ffff358594c in WebCore::SubresourceLoader::didFinishLoading (this=0x615a70, finishTime=0) at ../../Source/WebCore/loader/SubresourceLoader.cpp:306 #57 0x00007ffff35816e1 in WebCore::ResourceLoader::didFinishLoading (this=0x615a70, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:508 #58 0x00007ffff3f303e1 in WebCore::readCallback (asyncResult=0x7d31c0, data=0x616100) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1300 #59 0x00007fffeb7ab7d6 in async_ready_callback_wrapper (source_object=0x7ce830, res=0x7d31c0, user_data=user_data@entry=0x616100) at ginputstream.c:523 #60 0x00007fffeb7d10d5 in g_task_return_now (task=0x7d31c0) at gtask.c:1077 #61 0x00007fffeb7d10f9 in complete_in_idle_cb (task=0x7d31c0) at gtask.c:1086 #62 0x00007fffeaa10a1d in g_main_dispatch (context=0x47a580) at gmain.c:3064 #63 g_main_context_dispatch (context=context@entry=0x47a580) at gmain.c:3663 #64 0x00007fffeaa10d88 in g_main_context_iterate (context=0x47a580, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3734 #65 0x00007fffeaa1104a in g_main_loop_run (loop=0x4b8890) at gmain.c:3928 #66 0x00007ffff45df9dc in WTF::RunLoop::run () at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:59 #67 0x00007ffff2b44f82 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffd978) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61 #68 0x00007ffff2b44de7 in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffd978) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:73 #69 0x0000000000400891 in main (argc=2, argv=0x7fffffffd978) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:44
Reproduces under r204037.
<rdar://problem/27704339>
Created attachment 286855 [details] Test reduction
Created attachment 286867 [details] Patch
Comment on attachment 286867 [details] Patch R=me
Comment on attachment 286867 [details] Patch Clearing flags on attachment: 286867 Committed r204908: <http://trac.webkit.org/changeset/204908>
All reviewed patches have been landed. Closing bug.