Bug 155702 - ASSERTION FAILED: hasOverflowingCell == this->hasOverflowingCell() in WebCore::RenderTableSection::computeOverflowFromCells
Summary: ASSERTION FAILED: hasOverflowingCell == this->hasOverflowingCell() in WebCore...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: zalan
URL:
Keywords: InRadar
Depends on:
Blocks: 116980
  Show dependency tree / graph
 
Reported: 2016-03-20 11:04 PDT by Renata Hodovan
Modified: 2016-08-23 14:49 PDT (History)
10 users (show)

See Also:

Attachments
Test case (524 bytes, text/html)
2016-03-20 11:04 PDT, Renata Hodovan 		no flags Details
Test reduction (370 bytes, text/html)
2016-08-22 15:40 PDT, zalan 		no flags Details
Patch (3.91 KB, patch)
2016-08-23 13:50 PDT, zalan 		no flags Details | Formatted Diff | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Renata Hodovan 2016-03-20 11:04:36 PDT 
Created attachment 274545 [details]
Test case

Load the attached test with minibrowser:

<script>
window.onload = function() {
    window.scrollTo(0,document.body.scrollHeight);
    document.designMode = 'on';
    var parent = document.getElementById('foo');
    parent.removeChild(parent.childNodes[0]);

}
</script>
<style>
* {
    margin-top: -47%;
    text-emphasis-position: under right;
    position: relative;
    display: inline-table;
}
ins {
    position: absolute;
    text-emphasis-style: filled;
}
</style>
<li></li>
<table>
    <th>
        <ins><h3><pre><a>a<pre><ins><details></details></ins></pre></a></pre></h3></ins>
    </th>
</table>


OS: Ubuntu 15.10, x86_64  (also validated on Mac OS X 10.11.1 (x86_64), x86_64)
Checked build: debug EFL (and MAC)
Checked version: d5bbb4a


Backtrace:

ASSERTION FAILED: hasOverflowingCell == this->hasOverflowingCell()
../../Source/WebCore/rendering/RenderTableSection.cpp(712) : void WebCore::RenderTableSection::computeOverflowFromCells(unsigned int, unsigned int)
1   0x7fa4948e83a6 WTFCrash
2   0x7fa493896f75 WebCore::RenderTableSection::computeOverflowFromCells(unsigned int, unsigned int)
3   0x7fa493896d1e WebCore::RenderTableSection::computeOverflowFromCells()
4   0x7fa49387b031 WebCore::RenderTable::simplifiedNormalFlowLayout()
5   0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout()
6   0x7fa49387b0d0 WebCore::RenderTable::layout()
7   0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
8   0x7fa4936b10dc WebCore::RenderBlock::simplifiedNormalFlowLayout()
9   0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout()
10  0x7fa4936dead5 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
11  0x7fa493889680 WebCore::RenderTableCell::layout()
12  0x7fa493892e46 WebCore::RenderTableRow::layout()
13  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
14  0x7fa493895569 WebCore::RenderTableSection::layout()
15  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
16  0x7fa49387b537 WebCore::RenderTable::layout()
17  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
18  0x7fa4937053fe WebCore::RenderBlockFlow::layoutLineBoxes(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
19  0x7fa4936dfa97 WebCore::RenderBlockFlow::layoutInlineChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
20  0x7fa4936dee10 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
21  0x7fa493889680 WebCore::RenderTableCell::layout()
22  0x7fa493892e46 WebCore::RenderTableRow::layout()
23  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
24  0x7fa493895569 WebCore::RenderTableSection::layout()
25  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
26  0x7fa49387b025 WebCore::RenderTable::simplifiedNormalFlowLayout()
27  0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout()
28  0x7fa49387b0d0 WebCore::RenderTable::layout()
29  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
30  0x7fa4936b10dc WebCore::RenderBlock::simplifiedNormalFlowLayout()
31  0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout()
Comment 1 Brent Fulgham 2016-08-05 09:47:57 PDT 
This reproduces in r204037.
Comment 2 Radar WebKit Bug Importer 2016-08-05 09:48:10 PDT 
<rdar://problem/27720731>
Comment 3 zalan 2016-08-22 15:40:35 PDT 
Created attachment 286632 [details]
Test reduction
Comment 4 zalan 2016-08-23 13:50:39 PDT 
Created attachment 286767 [details]
Patch
Comment 5 Dave Hyatt 2016-08-23 14:23:24 PDT 
Comment on attachment 286767 [details]
Patch

r=me
Comment 6 WebKit Commit Bot 2016-08-23 14:49:03 PDT 
Comment on attachment 286767 [details]
Patch

Clearing flags on attachment: 286767

Committed r204860: <http://trac.webkit.org/changeset/204860>
Comment 7 WebKit Commit Bot 2016-08-23 14:49:07 PDT 
All reviewed patches have been landed.  Closing bug.