Bug 28295 - Assertion when background-image changes from multiple to single image
Summary: Assertion when background-image changes from multiple to single image
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 528+ (Nightly build)
Hardware: All OS X 10.5
: P2 Normal
Assignee: Simon Fraser (smfr)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-08-13 22:31 PDT by Simon Fraser (smfr)
Modified: 2009-08-13 23:25 PDT (History)
0 users

See Also:


Attachments
Testcase (948 bytes, text/html)
2009-08-13 22:31 PDT, Simon Fraser (smfr)
no flags Details
Patch, testcase (4.94 KB, patch)
2009-08-13 23:18 PDT, Simon Fraser (smfr)
mitz: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Simon Fraser (smfr) 2009-08-13 22:31:51 PDT
Created attachment 34810 [details]
Testcase

The attached testcase asserts. It changes the image background from using two images to one image. The assertion is:
ASSERTION FAILED: m_clients.contains(client)
(/Volumes/WebKit/WebKit.git/WebCore/loader/CachedResource.cpp:201 void WebCore::CachedResource::removeClient(WebCore::CachedResourceClient*))

from

#0  0x0000000100da0fe4 in WebCore::CachedResource::removeClient (this=0x11adb5ca0, client=0x11adb6058) at /Volumes/WebKit/WebKit.git/WebCore/loader/CachedResource.cpp:201
#1  0x000000010158b031 in WebCore::StyleCachedImage::removeClient (this=0x118b02440, renderer=0x11adb6058) at /Volumes/WebKit/WebKit.git/WebCore/rendering/style/StyleCachedImage.cpp:84
#2  0x00000001014a691f in WebCore::RenderObject::arenaDelete (this=0x11adb6058, arena=0x118b1e660, base=0x11adb6058) at /Volumes/WebKit/WebKit.git/WebCore/rendering/RenderObject.cpp:1864
#3  0x00000001014a6bb3 in WebCore::RenderObject::destroy (this=0x11adb6058) at /Volumes/WebKit/WebKit.git/WebCore/rendering/RenderObject.cpp:1856
#4  0x0000000101457f3d in WebCore::RenderBoxModelObject::destroy (this=0x11adb6058) at /Volumes/WebKit/WebKit.git/WebCore/rendering/RenderBoxModelObject.cpp:75
#5  0x000000010144ef1e in WebCore::RenderBox::destroy (this=0x11adb6058) at /Volumes/WebKit/WebKit.git/WebCore/rendering/RenderBox.cpp:95
#6  0x000000010141de57 in WebCore::RenderBlock::destroy (this=0x11adb6058) at /Volumes/WebKit/WebKit.git/WebCore/rendering/RenderBlock.cpp:204
#7  0x00000001013b6ed7 in WebCore::Node::detach (this=0x11adad7e0) at /Volumes/WebKit/WebKit.git/WebCore/dom/Node.cpp:1165
...
Comment 1 Simon Fraser (smfr) 2009-08-13 23:18:17 PDT
Created attachment 34813 [details]
Patch, testcase
Comment 2 Simon Fraser (smfr) 2009-08-13 23:25:08 PDT
http://trac.webkit.org/changeset/47270