The extra ASSERT()s in https://bugs.webkit.org/show_bug.cgi?id=49019 trigger on tables/mozilla_expected_failures/other/test4.html reduction: <!DOCTYPE html> <table> <CAPTION ALIGN=BOTTOM>caption</CAPTION> <CAPTION ALIGN=BOTTOM>caption</CAPTION> </table> render tree: RenderView 0x3dc3d28 #document 0x3dfef60 RenderBlock 0x3e3cea8 HTML 0x3e3c4d0 RenderBody 0x3e37e08 BODY 0x3e37cb0 RenderTable 0x3e37f98 TABLE 0x3e3d0d0 RenderBlock 0x3e38a78 CAPTION 0x3e384b0 RenderText 0x3e38b58 #text 0x3e38950 "caption" * RenderBlock 0x3e39ce8 CAPTION 0x3e39c40 RenderText 0x3e39e38 #text 0x3e39db0 "caption" at the end of RenderTable::layout() setNeedsLayout(false) is called on the RenderTable while the RenderBlock associated with the second caption still has m_needsLayout set.
RenderTable assumes that it only has to deal with one caption as an optimization, but this isn't really valid. You can actually end up rendering two captions on one table in some cases: <!DOCTYPE html> <table> <CAPTION>one</CAPTION> <CAPTION style="position:absolute;top:50px;left:50px">two</CAPTION> </table> We could forcibly remove all captions other than the first from the render tree, rather than just ignore them in RenderTable::layout(), if the desired rendering here is that only 'one' shows up.
CSS2.1 17.4 seems to be saying that we should render all captions in document order, which is what Opera and IE do. Gecko only renders captions beyond the first one if they are positioned which matches our current behavior. The most recent change I can see to this behavior is http://trac.webkit.org/changeset/40453. Is there a specific reason (compat or otherwise) that we want to only render one caption?
Since bug 69773, WebKit supports (and properly layout) several captions. I tried with the patch and the ASSERT doesn't trigger for the multiple captions case. Marking as FIXED.