[Webkit-unassigned] [Bug 108452] New: ASSERT(clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRectsType]) in RenderLayer

Thu Jan 31 03:08:47 PST 2013

https://bugs.webkit.org/show_bug.cgi?id=108452

           Summary: ASSERT(clipRectsContext.rootLayer ==
                    m_clipRectsCache->m_clipRectsRoot[clipRectsType]) in
                    RenderLayer
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: CSS
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: reni at webkit.org

I've got the following assert during HTML fuzzing:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff44927b8 in WebCore::RenderLayer::updateClipRects (this=0x7c70d8, clipRectsContext=...)
    at /home/reni/WebKit-git/Source/WebCore/rendering/RenderLayer.cpp:4521
4521            ASSERT(clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRectsType]);

The test:

<html>
<body style="-webkit-column-count: 2; -webkit-column-gap: 0">

    <div style="overflow: scroll">
        <div style="position: absolute;"></div>
        <div style="-webkit-box-reflect: below 2px"></div>
    </div>

</body>
</html>

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.