[Webkit-unassigned] [Bug 116964] New: ASSERTION FAILED: !m_nestedIsolateCount in WebCore::BidiResolver<Iterator, Run>::~BidiResolver()

Wed May 29 07:51:43 PDT 2013

https://bugs.webkit.org/show_bug.cgi?id=116964

           Summary: ASSERTION FAILED: !m_nestedIsolateCount in
                    WebCore::BidiResolver<Iterator, Run>::~BidiResolver()
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML Editing
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: reni at webkit.org

You get an assertion failure on the attached test.

Note:
The test looks like the following:

<html>
<body>
    <pre> <a dir="auto"><b dir="auto"></b></a> 
    </pre>
</body>
</html>

If you give a line break before <b> then no assertion happens.

Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff575275d in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:339
339        *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt
#0  0x00007ffff575275d in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:339
#1  0x00007ffff48ea0e9 in WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>::~BidiResolver (this=0x7fffffff99f0, __in_chrg=<optimized out>)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/text/BidiResolver.h:274
#2  0x00007ffff48db75f in WebCore::constructBidiRunsForSegment (topResolver=..., bidiRuns=..., endOfRuns=..., override=WebCore::NoVisualOverride, 
    previousLineBrokeCleanly=true) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:1356
#3  0x00007ffff48db834 in WebCore::constructBidiRunsForLine (block=0x8a59c8, topResolver=..., bidiRuns=..., endOfLine=..., 
    override=WebCore::NoVisualOverride, previousLineBrokeCleanly=true)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:1367
#4  0x00007ffff48dd626 in WebCore::RenderBlock::layoutRunsAndFloatsInRange (this=0x8a59c8, layoutState=..., resolver=..., cleanLineStart=..., 
    cleanLineBidiStatus=..., consecutiveHyphenatedLines=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:1810
#5  0x00007ffff48dc50b in WebCore::RenderBlock::layoutRunsAndFloats (this=0x8a59c8, layoutState=..., hasInlineChild=true)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:1603
#6  0x00007ffff48df53a in WebCore::RenderBlock::layoutInlineChildren (this=0x8a59c8, relayoutChildren=true, repaintLogicalTop=..., repaintLogicalBottom=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:2122
#7  0x00007ffff489460c in WebCore::RenderBlock::layoutBlock (this=0x8a59c8, relayoutChildren=true, pageLogicalHeight=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1643
#8  0x00007ffff4893a6d in WebCore::RenderBlock::layout (this=0x8a59c8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1432
#9  0x00007ffff4898f16 in WebCore::RenderBlock::layoutBlockChild (this=0x8ae378, child=0x8a59c8, marginInfo=..., previousFloatLogicalBottom=..., 
    maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:2628
#10 0x00007ffff4898b09 in WebCore::RenderBlock::layoutBlockChildren (this=0x8ae378, relayoutChildren=true, maxFloatLogicalBottom=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:2563

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.