Bug 151210 – ASSERTION FAILED: x2 >= x1 in WebCore::RenderElement::drawLineForBoxSide

• Status: RESOLVED
• Resolution: FIXED
• Component: Layout and Rendering

[Renata Hodovan]

Created attachment 265413 [details]
Test

Load the attached test with debug MiniBrowser:

<style>
* {
    outline-style: solid;
    outline-offset: 46392551rem;
}
</style>


OS: Ubuntu 15.04 x86_64
Checked build: debug EFL
Checked version: 08e34d6


Backtrace:

ASSERTION FAILED: x2 >= x1
../../Source/WebCore/rendering/RenderElement.cpp(1992) : void WebCore::RenderElement::drawLineForBoxSide(WebCore::GraphicsContext&, const WebCore::FloatRect&, WebCore::BoxSide, WebCore::Color, WebCore::EBorderStyle, float, float, bool) const
1   0x7f8f1eebba9f WTFCrash
2   0x7f8f25891a4d WebCore::RenderElement::drawLineForBoxSide(WebCore::GraphicsContext&, WebCore::FloatRect const&, WebCore::BoxSide, WebCore::Color, WebCore::EBorderStyle, float, float, bool) const
3   0x7f8f25892b0b WebCore::RenderElement::paintOutline(WebCore::PaintInfo&, WebCore::LayoutRect const&)
4   0x7f8f257e00ec WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
5   0x7f8f257df06f WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
6   0x7f8f257df793 WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool, WebCore::RenderBlock::PaintBlockType)
7   0x7f8f257df365 WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool)
8   0x7f8f257df2f2 WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
9   0x7f8f257dffa1 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
10  0x7f8f257df06f WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
11  0x7f8f2590728f WebCore::RenderLayer::paintForegroundForFragmentsWithPhase(WebCore::PaintPhase, WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow, 16ul> const&, WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int, WebCore::RenderObject*)
12  0x7f8f25906fd8 WebCore::RenderLayer::paintForegroundForFragments(WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow, 16ul> const&, WebCore::GraphicsContext&, WebCore::GraphicsContext&, WebCore::LayoutRect const&, bool, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int, WebCore::RenderObject*, bool)
13  0x7f8f259050a1 WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int)
14  0x7f8f2590387f WebCore::RenderLayer::paintLayerContentsAndReflection(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int)
15  0x7f8f2590375c WebCore::RenderLayer::paintLayer(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int)
16  0x7f8f25905915 WebCore::RenderLayer::paintList(WTF::Vector<WebCore::RenderLayer*, 0ul, WTF::CrashOnOverflow, 16ul>*, WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int)
17  0x7f8f2590516e WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int)
18  0x7f8f2592b9a4 WebCore::RenderLayerBacking::paintIntoLayer(WebCore::GraphicsLayer const*, WebCore::GraphicsContext&, WebCore::IntRect const&, unsigned int, unsigned int)
19  0x7f8f2592bd0e WebCore::RenderLayerBacking::paintContents(WebCore::GraphicsLayer const*, WebCore::GraphicsContext&, unsigned int, WebCore::FloatRect const&)
20  0x7f8f257137ee WebCore::GraphicsLayer::paintGraphicsLayerContents(WebCore::GraphicsContext&, WebCore::FloatRect const&)
21  0x7f8f25c83097 WebCore::CoordinatedGraphicsLayer::tiledBackingStorePaint(WebCore::GraphicsContext&, WebCore::IntRect const&)
22  0x7f8f26653b52 WebCore::Tile::paintToSurfaceContext(WebCore::GraphicsContext&)
23  0x7f8f25c8de0f WebCore::UpdateAtlasSurfaceClient::paintToSurfaceContext(WebCore::GraphicsContext&)
24  0x7f8f24cea317 WebKit::WebCoordinatedSurface::paintToSurface(WebCore::IntRect const&, WebCore::CoordinatedSurface::Client*)
25  0x7f8f25c8db4f WebCore::UpdateAtlas::paintOnAvailableBuffer(WebCore::IntSize const&, unsigned int&, WebCore::IntPoint&, WebCore::CoordinatedSurface::Client*)
26  0x7f8f25c778df WebCore::CompositingCoordinator::paintToSurface(WebCore::IntSize const&, unsigned int, unsigned int&, WebCore::IntPoint&, WebCore::CoordinatedSurface::Client*)
27  0x7f8f25c83578 WebCore::CoordinatedGraphicsLayer::paintToSurface(WebCore::IntSize const&, unsigned int&, WebCore::IntPoint&, WebCore::CoordinatedSurface::Client*)
28  0x7f8f266538fa WebCore::Tile::updateBackBuffer()
29  0x7f8f25c886fd WebCore::TiledBackingStore::updateTileBuffers()
30  0x7f8f25c89038 WebCore::TiledBackingStore::createTiles(WebCore::IntRect const&, WebCore::IntRect const&)
31  0x7f8f25c883ef WebCore::TiledBackingStore::createTilesIfNeeded(WebCore::IntRect const&, WebCore::IntRect const&)
Aborted (core dumped)

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f8f1eebbaa4 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321
321	    *(int *)(uintptr_t)0xbbadbeef = 0;
#0  0x00007f8f1eebbaa4 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321
#1  0x00007f8f25891a4d in WebCore::RenderElement::drawLineForBoxSide (this=0x7f8f067b72e0, graphicsContext=..., rect=..., side=WebCore::BSLeft, color=..., borderStyle=WebCore::SOLID, adjacentWidth1=3, adjacentWidth2=3, antialias=false) at ../../Source/WebCore/rendering/RenderElement.cpp:1992
#2  0x00007f8f25892b0b in WebCore::RenderElement::paintOutline (this=0x7f8f067b72e0, paintInfo=..., paintRect=...) at ../../Source/WebCore/rendering/RenderElement.cpp:2127
#3  0x00007f8f257e00ec in WebCore::RenderBlock::paintObject (this=0x7f8f067b72e0, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:1604
#4  0x00007f8f257df06f in WebCore::RenderBlock::paint (this=0x7f8f067b72e0, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:1420
#5  0x00007f8f257df793 in WebCore::RenderBlock::paintChild (this=0x7f8f067b7228, child=..., paintInfo=..., paintOffset=..., paintInfoForChild=..., usePrintRect=false, paintType=WebCore::RenderBlock::PaintAsBlock) at ../../Source/WebCore/rendering/RenderBlock.cpp:1494
#6  0x00007f8f257df365 in WebCore::RenderBlock::paintChildren (this=0x7f8f067b7228, paintInfo=..., paintOffset=..., paintInfoForChild=..., usePrintRect=false) at ../../Source/WebCore/rendering/RenderBlock.cpp:1461
#7  0x00007f8f257df2f2 in WebCore::RenderBlock::paintContents (this=0x7f8f067b7228, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:1454
#8  0x00007f8f257dffa1 in WebCore::RenderBlock::paintObject (this=0x7f8f067b7228, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:1590
#9  0x00007f8f257df06f in WebCore::RenderBlock::paint (this=0x7f8f067b7228, paintInfo=..., paintOffset=...) at ../../Source/WebCore/rendering/RenderBlock.cpp:1420
#10 0x00007f8f2590728f in WebCore::RenderLayer::paintForegroundForFragmentsWithPhase (this=0x7f8f066fe7e0, phase=WebCore::PaintPhaseChildOutlines, layerFragments=..., context=..., localPaintingInfo=..., paintBehavior=0, subtreePaintRootForRenderer=0x0) at ../../Source/WebCore/rendering/RenderLayer.cpp:4735
#11 0x00007f8f25906fd8 in WebCore::RenderLayer::paintForegroundForFragments (this=0x7f8f066fe7e0, layerFragments=..., context=..., transparencyLayerContext=..., transparencyPaintDirtyRect=..., haveTransparency=false, localPaintingInfo=..., paintBehavior=0, subtreePaintRootForRenderer=0x0, selectionOnly=false) at ../../Source/WebCore/rendering/RenderLayer.cpp:4713
#12 0x00007f8f259050a1 in WebCore::RenderLayer::paintLayerContents (this=0x7f8f066fe7e0, originalContext=..., paintingInfo=..., paintFlags=96) at ../../Source/WebCore/rendering/RenderLayer.cpp:4328
#13 0x00007f8f2590387f in WebCore::RenderLayer::paintLayerContentsAndReflection (this=0x7f8f066fe7e0, context=..., paintingInfo=..., paintFlags=96) at ../../Source/WebCore/rendering/RenderLayer.cpp:3984
#14 0x00007f8f2590375c in WebCore::RenderLayer::paintLayer (this=0x7f8f066fe7e0, context=..., paintingInfo=..., paintFlags=96) at ../../Source/WebCore/rendering/RenderLayer.cpp:3966
#15 0x00007f8f25905915 in WebCore::RenderLayer::paintList (this=0x7f8f066fe5a0, list=0x7f8f067fb620, context=..., paintingInfo=..., paintFlags=96) at ../../Source/WebCore/rendering/RenderLayer.cpp:4433
#16 0x00007f8f2590516e in WebCore::RenderLayer::paintLayerContents (this=0x7f8f066fe5a0, originalContext=..., paintingInfo=..., paintFlags=96) at ../../Source/WebCore/rendering/RenderLayer.cpp:4339
#17 0x00007f8f2592b9a4 in WebCore::RenderLayerBacking::paintIntoLayer (this=0x7f8f067d9498, graphicsLayer=0x7f8f0642e000, context=..., paintDirtyRect=..., paintBehavior=0, paintingPhase=3) at ../../Source/WebCore/rendering/RenderLayerBacking.cpp:2303
#18 0x00007f8f2592bd0e in WebCore::RenderLayerBacking::paintContents (this=0x7f8f067d9498, graphicsLayer=0x7f8f0642e000, context=..., paintingPhase=3, clip=...) at ../../Source/WebCore/rendering/RenderLayerBacking.cpp:2341
#19 0x00007f8f257137ee in WebCore::GraphicsLayer::paintGraphicsLayerContents (this=0x7f8f0642e000, context=..., clip=...) at ../../Source/WebCore/platform/graphics/GraphicsLayer.cpp:413
#20 0x00007f8f25c83097 in WebCore::CoordinatedGraphicsLayer::tiledBackingStorePaint (this=0x7f8f0642e000, context=..., rect=...) at ../../Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:876
#21 0x00007f8f26653b52 in WebCore::Tile::paintToSurfaceContext (this=0x966480, context=...) at ../../Source/WebCore/platform/graphics/texmap/coordinated/Tile.cpp:100
#22 0x00007f8f25c8de0f in WebCore::UpdateAtlasSurfaceClient::paintToSurfaceContext (this=0x7ffdb5b44970, context=...) at ../../Source/WebCore/platform/graphics/texmap/coordinated/UpdateAtlas.cpp:50
#23 0x00007f8f24cea317 in WebKit::WebCoordinatedSurface::paintToSurface (this=0x7f8f067d6fc8, rect=..., client=0x7ffdb5b44970) at ../../Source/WebKit2/Shared/CoordinatedGraphics/WebCoordinatedSurface.cpp:190
#24 0x00007f8f25c8db4f in WebCore::UpdateAtlas::paintOnAvailableBuffer (this=0xa19290, size=..., atlasID=@0x7ffdb5b44ad0: 1, offset=..., client=0x966480) at ../../Source/WebCore/platform/graphics/texmap/coordinated/UpdateAtlas.cpp:110
#25 0x00007f8f25c778df in WebCore::CompositingCoordinator::paintToSurface (this=0x7f8f066e0000, size=..., flags=0, atlasID=@0x7ffdb5b44ad0: 1, offset=..., client=0x966480) at ../../Source/WebCore/platform/graphics/texmap/coordinated/CompositingCoordinator.cpp:383
#26 0x00007f8f25c83578 in WebCore::CoordinatedGraphicsLayer::paintToSurface (this=0x7f8f0642e000, size=..., atlas=@0x7ffdb5b44ad0: 1, offset=..., client=0x966480) at ../../Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:926
#27 0x00007f8f266538fa in WebCore::Tile::updateBackBuffer (this=0x966480) at ../../Source/WebCore/platform/graphics/texmap/coordinated/Tile.cpp:75
#28 0x00007f8f25c886fd in WebCore::TiledBackingStore::updateTileBuffers (this=0x7f8f067cd850) at ../../Source/WebCore/platform/graphics/texmap/coordinated/TiledBackingStore.cpp:100
#29 0x00007f8f25c89038 in WebCore::TiledBackingStore::createTiles (this=0x7f8f067cd850, visibleRect=..., scaledContentsRect=...) at ../../Source/WebCore/platform/graphics/texmap/coordinated/TiledBackingStore.cpp:234
#30 0x00007f8f25c883ef in WebCore::TiledBackingStore::createTilesIfNeeded (this=0x7f8f067cd850, unscaledVisibleRect=..., contentsRect=...) at ../../Source/WebCore/platform/graphics/texmap/coordinated/TiledBackingStore.cpp:64
#31 0x00007f8f25c83aba in WebCore::CoordinatedGraphicsLayer::updateContentBuffers (this=0x7f8f0642e000) at ../../Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:995
#32 0x00007f8f25c838d8 in WebCore::CoordinatedGraphicsLayer::updateContentBuffersIncludingSubLayers (this=0x7f8f0642e000) at ../../Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:967
#33 0x00007f8f25c83929 in WebCore::CoordinatedGraphicsLayer::updateContentBuffersIncludingSubLayers (this=0x7f8f06448cc0) at ../../Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:970
#34 0x00007f8f25c83929 in WebCore::CoordinatedGraphicsLayer::updateContentBuffersIncludingSubLayers (this=0x7f8f0641d180) at ../../Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:970
#35 0x00007f8f25c7612b in WebCore::CompositingCoordinator::flushPendingLayerChanges (this=0x7f8f066e0000) at ../../Source/WebCore/platform/graphics/texmap/coordinated/CompositingCoordinator.cpp:99
#36 0x00007f8f24d9d9ba in WebKit::CoordinatedLayerTreeHost::performScheduledLayerFlush (this=0x7f8f067e2210) at ../../Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedLayerTreeHost.cpp:212
#37 0x00007f8f24d9da72 in WebKit::CoordinatedLayerTreeHost::layerFlushTimerFired (this=0x7f8f067e2210) at ../../Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedLayerTreeHost.cpp:227
#38 0x00007f8f24d9f2bb in std::_Mem_fn<void (WebKit::CoordinatedLayerTreeHost::*)()>::operator()<, void>(WebKit::CoordinatedLayerTreeHost*) const (this=0x9829a0, __object=0x7f8f067e2210) at /usr/include/c++/4.9/functional:569
#39 0x00007f8f24d9f16d in std::_Bind<std::_Mem_fn<void (WebKit::CoordinatedLayerTreeHost::*)()> (WebKit::CoordinatedLayerTreeHost*)>::__call<void, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) (this=0x9829a0, __args=<unknown type in webkit/WebKitBuild/Debug/lib/libewebkit2.so.1, CU 0x105be6f6, DIE 0x107312b0>) at /usr/include/c++/4.9/functional:1264
#40 0x00007f8f24d9efe5 in std::_Bind<std::_Mem_fn<void (WebKit::CoordinatedLayerTreeHost::*)()> (WebKit::CoordinatedLayerTreeHost*)>::operator()<, void>() (this=0x9829a0) at /usr/include/c++/4.9/functional:1323
#41 0x00007f8f24d9ed3e in std::_Function_handler<void (), std::_Bind<std::_Mem_fn<void (WebKit::CoordinatedLayerTreeHost::*)()> (WebKit::CoordinatedLayerTreeHost*)> >::_M_invoke(std::_Any_data const&) (__functor=...) at /usr/include/c++/4.9/functional:2039
#42 0x00007f8f24802182 in std::function<void ()>::operator()() const (this=0x7f8f067e2280) at /usr/include/c++/4.9/functional:2439
#43 0x00007f8f248ae99a in WebCore::Timer::fired (this=0x7f8f067e2248) at ../../Source/WebCore/platform/Timer.h:133
#44 0x00007f8f256a3c71 in WebCore::ThreadTimers::sharedTimerFiredInternal (this=0x7f8f067d6258) at ../../Source/WebCore/platform/ThreadTimers.cpp:121
#45 0x00007f8f256a385f in WebCore::ThreadTimers::<lambda()>::operator()(void) const (__closure=0x981de0) at ../../Source/WebCore/platform/ThreadTimers.cpp:73
#46 0x00007f8f256a3e82 in std::_Function_handler<void(), WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::<lambda()> >::_M_invoke(const std::_Any_data &) (__functor=...) at /usr/include/c++/4.9/functional:2039
#47 0x00007f8f24802182 in std::function<void ()>::operator()() const (this=0x7f8f2a591c68 <WebCore::MainThreadSharedTimer::singleton()::instance+8>) at /usr/include/c++/4.9/functional:2439
#48 0x00007f8f2643da89 in WebCore::MainThreadSharedTimer::fired (this=0x7f8f2a591c60 <WebCore::MainThreadSharedTimer::singleton()::instance>) at ../../Source/WebCore/platform/MainThreadSharedTimer.cpp:52
#49 0x00007f8f26646810 in WebCore::timerEvent () at ../../Source/WebCore/platform/efl/MainThreadSharedTimerEfl.cpp:44
#50 0x00007f8f1c879d1e in _ecore_call_task_cb (data=<optimized out>, func=<optimized out>) at lib/ecore/ecore_private.h:336
#51 _ecore_timer_expired_call (when=1156964.625982678) at lib/ecore/ecore_timer.c:733
#52 0x00007f8f1c879e6b in _ecore_timer_expired_timers_call (when=1156964.625982678) at lib/ecore/ecore_timer.c:686
#53 0x00007f8f1c875b41 in _ecore_main_loop_iterate_internal (once_only=once_only@entry=0) at lib/ecore/ecore_main.c:1812
#54 0x00007f8f1c875fc7 in ecore_main_loop_begin () at lib/ecore/ecore_main.c:983
#55 0x00007f8f1ef16995 in WTF::RunLoop::run () at ../../Source/WTF/wtf/efl/RunLoopEfl.cpp:49
#56 0x00007f8f24da2c11 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7ffdb5b453f8) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61
#57 0x00007f8f24da281f in WebKit::WebProcessMainUnix (argc=2, argv=0x7ffdb5b453f8) at ../../Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp:161
#58 0x00000000004008ea in main (argc=2, argv=0x7ffdb5b453f8) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:44

[zalan]

Created attachment 267908 [details]
Patch

[Build Bot]

Comment on attachment 267908 [details]
Patch

Attachment 267908 [details] did not pass mac-debug-ews (mac):
Output: http://webkit-queues.webkit.org/results/604183

New failing tests:
fast/borders/outline-offset-overflow.html

[Build Bot]

Created attachment 267909 [details]
Archive of layout-test-results from ews116 for mac-yosemite

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews116  Port: mac-yosemite  Platform: Mac OS X 10.10.5

[zalan]

Created attachment 267911 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 267911 [details]
Patch

Clearing flags on attachment: 267911

Committed r194418: <http://trac.webkit.org/changeset/194418>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.