[Webkit-unassigned] [Bug 99796] ASSERTION FAILED: m_next in LayoutState.cpp

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=99796





--- Comment #4 from Dave Barton <dbarton at mathscribe.com>  2012-10-26 17:11:53 PST ---
Thanks very much to smfr and eseidel for helping me with LayoutState in irc chat.

I now have a patch for this but don't know how to test it. This bug occurs when something asks for a typical MathML object's preferred logical width(s) when *not* doing an actual layout, so there's no LayoutState. How can I make this happen, especially during LayoutTestRunner? I can't reproduce this exact bug (99796), and I don't see the bottom of the stack trace in comment 0 here. A Chrome Canary user is crashing with a stack trace ending (at least the version I've seen) with:

0x020a5e3e    [Google Chrome Framework]    - RenderBox.cpp:665]    WebCore::RenderBox::minPreferredLogicalWidth
0x014afb6f    [Google Chrome Framework]    - WebFrameImpl.cpp:646]    WebKit::WebFrameImpl::contentsPreferredWidth

This is inside Source/WebKit/chromium/src/WebFrameImpl.cpp, which is chromium-specific, right? There's also a big stack trace in bug 100464, which I think is a duplicate of this bug. Finally, on my machine the first test case in bug 100465 apparently causes this bug also, with a stack trace I just attached here.

I see repainting tests in LayoutTests, but I need something different here. Any short explanation, example or hint would be greatly appreciated!

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.