[Webkit-unassigned] [Bug 108619] New: ASSERT(enclosingIntRect(rendererMappedResult) == enclosingIntRect(FloatQuad(result).boundingBox())) in RenderGeometryMap
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Fri Feb 1 05:21:51 PST 2013
https://bugs.webkit.org/show_bug.cgi?id=108619
Summary: ASSERT(enclosingIntRect(rendererMappedResult) ==
enclosingIntRect(FloatQuad(result).boundingBox())) in
RenderGeometryMap
Product: WebKit
Version: 528+ (Nightly build)
Platform: Unspecified
OS/Version: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: Layout and Rendering
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: reni at webkit.org
CC: simon.fraser at apple.com, jberlin at webkit.org
During CSS fuzzing I've got the following assertion faulire:
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff5632d50 in WebCore::RenderGeometryMap::mapToContainer (this=0x7fffffffc7a0, rect=..., container=0x0)
at /home/reni/repos/webkit2/Source/WebCore/rendering/RenderGeometryMap.cpp:142
142 ASSERT(enclosingIntRect(rendererMappedResult) == enclosingIntRect(FloatQuad(result).boundingBox()));
The test:
<html id="test-element">
<head>
<style>
#test-element {font-size: 354em;}
</style>
<body>
<div id="test-element" style="margin: 131em;"></div>
<div id=word style="-webkit-box-shadow: 2px -2px;position: absolute; margin:131em;"></div>
</body>
</html>
I've seen bugs (Qt: #89466, WIN: #88128) with similar issues but they are working for me right now.
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list