Bug 132117

Summary: [CSS Regions] In some situations, flowing the body into a flow thread causes an assertion failure
Product: WebKit Reporter: Radu Stavila <stavila>
Component: CSSAssignee: Nobody <webkit-unassigned>
Status: RESOLVED WONTFIX    
Severity: Normal CC: bfulgham
Priority: P2 Keywords: AdobeTracked
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 57312    
Attachments:
Description Flags
Test-case none

Radu Stavila
Reported 2014-04-24 01:55:15 PDT
See attached test-case. OUTPUT: ASSERTION FAILED: m_invalidRegionList.contains(renderNamedFlowFragment) /Adobe/WebKit/Source/WebCore/rendering/RenderNamedFlowThread.cpp(257) : virtual void WebCore::RenderNamedFlowThread::removeRegionFromThread(WebCore::RenderRegion *) 1 0x108459d50 WTFCrash 2 0x10b49a625 WebCore::RenderNamedFlowThread::removeRegionFromThread(WebCore::RenderRegion*) 3 0x10b4bcf6f WebCore::RenderRegion::detachRegion() 4 0x10b496073 WebCore::RenderNamedFlowFragment::detachRegion() 5 0x10b4bd467 WebCore::RenderRegion::willBeRemovedFromTree() 6 0x10b3839d8 WebCore::RenderElement::removeChildInternal(WebCore::RenderObject&, WebCore::RenderElement::NotifyChildrenType) 7 0x10b3837b2 WebCore::RenderElement::removeChild(WebCore::RenderObject&) 8 0x10b2b6b93 WebCore::RenderBlock::removeChild(WebCore::RenderObject&) 9 0x10b306c1d WebCore::RenderBlockFlow::removeChild(WebCore::RenderObject&) 10 0x10b4aacf6 WebCore::RenderObject::removeFromParent() 11 0x10b4b40e6 WebCore::RenderObject::willBeDestroyed() 12 0x10b385570 WebCore::RenderElement::willBeDestroyed() 13 0x10b45e016 WebCore::RenderLayerModelObject::willBeDestroyed() 14 0x10b34d1f6 WebCore::RenderBoxModelObject::willBeDestroyed() 15 0x10b326d7a WebCore::RenderBox::willBeDestroyed() 16 0x10b2efafc WebCore::RenderBlockFlow::willBeDestroyed() 17 0x10b4b452d WebCore::RenderObject::destroy() 18 0x10b2efb4f WebCore::RenderBlockFlow::setRenderNamedFlowFragment(WebCore::RenderNamedFlowFragment*) 19 0x10b2ef95e WebCore::RenderBlockFlow::willBeDestroyed() 20 0x10b4b452d WebCore::RenderObject::destroy() 21 0x10b4b4502 WebCore::RenderObject::destroyAndCleanupAnonymousWrappers() 22 0x10b847f05 WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) 23 0x10b849f7a WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) 24 0x10b847ed9 WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) 25 0x10b84a176 WebCore::Style::resolveLocal(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) 26 0x10b847b0b WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) 27 0x10b847d49 WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change) 28 0x10b8479b8 WebCore::Style::resolveTree(WebCore::Document&, WebCore::Style::Change) 29 0x10a160c86 WebCore::Document::recalcStyle(WebCore::Style::Change) 30 0x10a15d20f WebCore::Document::updateStyleIfNeeded() 31 0x10a16cf02 WebCore::Document::finishedParsing()
Attachments
Test-case (1.49 KB, text/html)
2014-04-24 01:56 PDT, Radu Stavila 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Radu Stavila
Comment 1 2014-04-24 01:56:51 PDT
Created attachment 230064 [details] Test-case
Brent Fulgham
Comment 2 2022-07-12 17:21:53 PDT
CSS Regions were removed in Bug 174978.
Note You need to log in before you can comment on or make changes to this bug.