Failing the ASSERT(m_clients.contains(renderer)) in CSSGradientValue::image() because the body's background propagates to the root. See attached test case.
Created attachment 20494 [details] Test case (will ASSERT)
*** Bug 19030 has been marked as a duplicate of this bug. ***
<rdar://problem/5931174>
Note that -webkit-canvas has the same problem. ASSERT(m_clients.contains(renderer)); in CSSCanvasValue::image There are a few options. 1. add the canvas and gradient as clients before asking for the images. I expect this wastes memory in the case where a canvas/gradient is set on the body, then removed. 2. remove the asserts. Since gradient calls getImage and it causes the renderer to be added as a client I don't think it is a big deal, but I didn't investigate much. I didn't try this with canvas. 3. Work out why body elements are not doing the right thing with updateFillImages from RenderObject::setStyle, which is where other elements add gradients and canvas as clients.
Created attachment 25730 [details] testcases for gradient and canvas on body here are two layout tests that will trigger the assert
(In reply to comment #4) > 3. Work out why body elements are not doing the right thing with > updateFillImages from RenderObject::setStyle, which is where other elements add > gradients and canvas as clients. I think this is the first option to pursue. If I am not mistaken, it has to do with the special rules for background-image propagation from <body> to <html>.
Created attachment 30802 [details] Change paintFillLayerExtended() to use body's renderer as the StyleImage client when the background is propagated from body to root
Comment on attachment 30802 [details] Change paintFillLayerExtended() to use body's renderer as the StyleImage client when the background is propagated from body to root r=me
Fixed in <http://trac.webkit.org/changeset/44285>.