[Webkit-unassigned] [Bug 93891] ASSERTION FAILED: !currBox->needsLayout() loading bing maps

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=93891


Zalan Bujtas <zbujtas at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |zbujtas at gmail.com




--- Comment #2 from Zalan Bujtas <zbujtas at gmail.com>  2012-09-16 03:44:26 PST ---
1, When the div's position attribute is changed from fixed to absolute (c.style.position = "absolute";), it first gets removed and then added back to gPositionedDescendantsMap ListHashSet (RenderBlock::removePositionedObject/insertPositionedObject). 
2, With nested positioned divs, after the position attribute change of the outer div (remove-insert), the inner div gets in front of the outer in the positionedDescendatnsMap. 
3, During a subsequent layout, as RenderBlock::layoutPositionedObjects() iterates through the positioned objects, it first lays out the inner div followed by the outer div.
4, The inner div is marked dirty at RenderBlock::layoutInlineChildren(), while the outer div is being layed out.
5, RenderBlock::layoutPositionedObjects() leaves with the inner div marked dirty.
->ASSERT.

Not sure why we are marking the fixed positioned inner div dirty, when only the outer (non containing) div is changed (but not the containing block), but the actual fix I think is to make sure the ListHashSet of the positioned objects is in the right order. Proposed fix is coming.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.