Bug 155702 – ASSERTION FAILED: hasOverflowingCell == this->hasOverflowingCell() in WebCore::RenderTableSection::computeOverflowFromCells

• Status: RESOLVED
• Resolution: FIXED
• Component: Layout and Rendering

[Renata Hodovan]

Created attachment 274545 [details]
Test case

Load the attached test with minibrowser:

<script>
window.onload = function() {
    window.scrollTo(0,document.body.scrollHeight);
    document.designMode = 'on';
    var parent = document.getElementById('foo');
    parent.removeChild(parent.childNodes[0]);

}
</script>
<style>
* {
    margin-top: -47%;
    text-emphasis-position: under right;
    position: relative;
    display: inline-table;
}
ins {
    position: absolute;
    text-emphasis-style: filled;
}
</style>
<li></li>
<table>
    <th>
        <ins><h3><pre><a>a<pre><ins><details></details></ins></pre></a></pre></h3></ins>
    </th>
</table>


OS: Ubuntu 15.10, x86_64  (also validated on Mac OS X 10.11.1 (x86_64), x86_64)
Checked build: debug EFL (and MAC)
Checked version: d5bbb4a


Backtrace:

ASSERTION FAILED: hasOverflowingCell == this->hasOverflowingCell()
../../Source/WebCore/rendering/RenderTableSection.cpp(712) : void WebCore::RenderTableSection::computeOverflowFromCells(unsigned int, unsigned int)
1   0x7fa4948e83a6 WTFCrash
2   0x7fa493896f75 WebCore::RenderTableSection::computeOverflowFromCells(unsigned int, unsigned int)
3   0x7fa493896d1e WebCore::RenderTableSection::computeOverflowFromCells()
4   0x7fa49387b031 WebCore::RenderTable::simplifiedNormalFlowLayout()
5   0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout()
6   0x7fa49387b0d0 WebCore::RenderTable::layout()
7   0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
8   0x7fa4936b10dc WebCore::RenderBlock::simplifiedNormalFlowLayout()
9   0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout()
10  0x7fa4936dead5 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
11  0x7fa493889680 WebCore::RenderTableCell::layout()
12  0x7fa493892e46 WebCore::RenderTableRow::layout()
13  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
14  0x7fa493895569 WebCore::RenderTableSection::layout()
15  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
16  0x7fa49387b537 WebCore::RenderTable::layout()
17  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
18  0x7fa4937053fe WebCore::RenderBlockFlow::layoutLineBoxes(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
19  0x7fa4936dfa97 WebCore::RenderBlockFlow::layoutInlineChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
20  0x7fa4936dee10 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
21  0x7fa493889680 WebCore::RenderTableCell::layout()
22  0x7fa493892e46 WebCore::RenderTableRow::layout()
23  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
24  0x7fa493895569 WebCore::RenderTableSection::layout()
25  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
26  0x7fa49387b025 WebCore::RenderTable::simplifiedNormalFlowLayout()
27  0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout()
28  0x7fa49387b0d0 WebCore::RenderTable::layout()
29  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
30  0x7fa4936b10dc WebCore::RenderBlock::simplifiedNormalFlowLayout()
31  0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout()

[Brent Fulgham]

This reproduces in r204037.

[Radar WebKit Bug Importer]

<rdar://problem/27720731>

[zalan]

Created attachment 286632 [details]
Test reduction

[zalan]

Created attachment 286767 [details]
Patch

[Dave Hyatt]

Comment on attachment 286767 [details]
Patch

r=me

[WebKit Commit Bot]

Comment on attachment 286767 [details]
Patch

Clearing flags on attachment: 286767

Committed r204860: <http://trac.webkit.org/changeset/204860>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.