If we miss invalidating simple line layout path properly, we could end up in FlowContents->initializeSegments with a renderer that we don't support yet.
Created attachment 254824 [details] Patch
It results in broken rendering (missing pieces) vs. crash.
Comment on attachment 254824 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=254824&action=review > Source/WebCore/rendering/SimpleLineLayoutFlowContents.cpp:50 > continue; > - } > - ASSERT(is<RenderText>(child)); > - const auto& textChild = downcast<RenderText>(child); > - unsigned textLength = textChild.text()->length(); > - segments.append(FlowContents::Segment { startPosition, startPosition + textLength, textChild.text(), textChild }); > - startPosition += textLength; > + } else if (is<RenderText>(child)) { No need to say 'else' after 'continue'.
Comment on attachment 254824 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=254824&action=review > Source/WebCore/rendering/SimpleLineLayoutFlowContents.cpp:56 > + startPosition += textLength; > + } else > + ASSERT_NOT_REACHED(); This too could do continue without else.
Created attachment 254846 [details] Patch
Comment on attachment 254846 [details] Patch Clearing flags on attachment: 254846 Committed r185531: <http://trac.webkit.org/changeset/185531>
All reviewed patches have been landed. Closing bug.