The ASSERT can be hit pretty easily when a flex box (deprecated or not) is involved (see test case). It seems that the code is confused in RenderObjectChildList::updateBeforeAfterStyle. My analysis is that the parent |beforeAfterParent| is wrongly chosen which makes us not update the right children.
Created attachment 151755 [details] Reproduction: should hit the ASSERT in Debug
Created attachment 151757 [details] Proposed change 1: Do not return the flex box wrapper but search for the proper generated content parent.
Comment on attachment 151757 [details] Proposed change 1: Do not return the flex box wrapper but search for the proper generated content parent. View in context: https://bugs.webkit.org/attachment.cgi?id=151757&action=review > Source/WebCore/rendering/RenderObjectChildList.cpp:292 > // Only table parts need to search for the :before or :after parent Please fix this comment since we now include flexboxes. Probably add a FIXME that we should instead use isAnonymous to cover any anonymous containers. > LayoutTests/fast/flexbox/assert-generated-deprecated-flexbox.html:5 > + content: 'Generated content wrapped in a flex-box.'; nit: this should be indented right. same for the other test.
Created attachment 151990 [details] Patch for landing
Comment on attachment 151757 [details] Proposed change 1: Do not return the flex box wrapper but search for the proper generated content parent. View in context: https://bugs.webkit.org/attachment.cgi?id=151757&action=review >> Source/WebCore/rendering/RenderObjectChildList.cpp:292 >> // Only table parts need to search for the :before or :after parent > > Please fix this comment since we now include flexboxes. Probably add a FIXME that we should instead use isAnonymous to cover any anonymous containers. Done, also added a FIXME that we could probably get away without the check for future reference. >> LayoutTests/fast/flexbox/assert-generated-deprecated-flexbox.html:5 >> + content: 'Generated content wrapped in a flex-box.'; > > nit: this should be indented right. same for the other test. Done.
Comment on attachment 151990 [details] Patch for landing Clearing flags on attachment: 151990 Committed r122502: <http://trac.webkit.org/changeset/122502>
All reviewed patches have been landed. Closing bug.