[Webkit-unassigned] [Bug 110270] Lots of LayoutUnit assertions when loading a Wikipedia article

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=110270





--- Comment #2 from Emil A Eklund <eae at chromium.org>  2013-02-19 15:59:24 PST ---
(In reply to comment #0)
> When loading http://en.wikipedia.org/wiki/Turban_Head_eagle (today's Wikipedia featured article) in a ToT (r143269) debug build, I get lots of non-fatal LayoutUnit assertions:
> 
> Source/WebCore/platform/LayoutUnit.h(180) : unsigned int WebCore::LayoutUnit::toUnsigned() const
> ERROR: !(isInBounds(value))
> Source/WebCore/platform/LayoutUnit.h(338) : void WebCore::LayoutUnit::setValue(unsigned int)
> ERROR: !(m_value >= 0)
> Source/WebCore/platform/LayoutUnit.h(180) : unsigned int WebCore::LayoutUnit::toUnsigned() const
> ERROR: !(isInBounds(value))
> Source/WebCore/platform/LayoutUnit.h(338) : void WebCore::LayoutUnit::setValue(unsigned int)

The column code strikes again.
If the startOffset in RenderBlock::adjustRectForColumns is negative the startColumn computation will give a negative value and assigning that to an unsigned is what triggers the assertions.

Not quite sure that the right fix is.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.