[Webkit-unassigned] [Bug 122237] New: [mac][wk2] REGRESSION (Tiled Drawing): fast/table/crash-section-logical-height-changed-needsCellRecalc.html asserts

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=122237

           Summary: [mac][wk2] REGRESSION (Tiled Drawing):
                    fast/table/crash-section-logical-height-changed-needsC
                    ellRecalc.html asserts
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Tools / Tests
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: thorton at apple.com
                CC: hyatt at apple.com, andersca at apple.com,
                    simon.fraser at apple.com, rniwa at webkit.org,
                    enrica at apple.com


While painting, we see:

ASSERTION FAILED: static_cast<unsigned>(m_start + length) <= string.length()
virtual void WebCore::InlineTextBox::paint(WebCore::PaintInfo &, const WebCore::LayoutPoint &, WebCore::LayoutUnit, WebCore::LayoutUnit)
1   0x109d423e0 WTFCrash
2   0x10b5cc938 WebCore::InlineTextBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit)
3   0x10b5bcef1 WebCore::InlineFlowBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit)
4   0x10c188e64 WebCore::RootInlineBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit)

It's 100% reproducible with a recent debug build, the patch in bug 121859, and WebKitTestRunner.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.