[Webkit-unassigned] [Bug 108199] New: Assertion faulire in RenderObject::offsetFromAncestorContainer

Tue Jan 29 08:30:25 PST 2013

https://bugs.webkit.org/show_bug.cgi?id=108199

           Summary: Assertion faulire in
                    RenderObject::offsetFromAncestorContainer
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: CSS
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: reni at webkit.org

During CSS fuzzing I've got an assertion fauilre:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff56d1f9b in WebCore::RenderObject::offsetFromAncestorContainer (this=0x85c548, container=0x6f43a8)
    at /home/reni/repos/webkit2/Source/WebCore/rendering/RenderObject.cpp:2219
2219            ASSERT(!currContainer->hasTransform());

The following test caused the problem:

<html>   
    <body>     
        <table>       
            <tr style="-webkit-perspective: 10;">           
                <td style="position: absolute;" ></td>           
            </tr>         
        </table>     
    </body>
</html>

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.