I have found that a number of layout tests are crashing on Windows in release builds because the RenderLayer's m_enclosingPaginationLayer is invalid.
Debugging indicates the following:
1. In RenderLayer::updatePagination(), the RenderLayer sets its m_enclosingPaginationLayer to the result of parent()->enclosingPaginationLayer(IncludeCompositedPaginatedLayers); This is a valid RenderLayer.
2. Later, the RenderLayer we assigned in the first step is deleted during a later stage of layout.
3. RenderLayer::m_enclosingPaginationLayer is not set to nullptr, and becomes a dangling pointer.
4. Later, RenderLayer::hasCompositedLayerInEnclosingPaginationChain() is called, which attempts to call 'isComposited' through the garbage m_enclosingPaginationLayer.
The issue seems to be that the destruction of the RenderLayer referenced by m_enclosingPaginationLayer is not communicated back to the RenderLayer holding this pointer, so it doesn't know that the value is invalid.
Smells like rdar://problem/17873488
I wonder if this is only hit in WK1?
I am seeing this with the test "fast/dynamic/layer-no-longer-paginated.html"
Created attachment 244627 [details]
Some dump analysis.
This is exactly rdar://problem/17873488
*** This bug has been marked as a duplicate of bug 135514 ***