[Webkit-unassigned] [Bug 132117] New: [CSS Regions] In some situations, flowing the body into a flow thread causes an assertion failure

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=132117

           Summary: [CSS Regions] In some situations, flowing the body
                    into a flow thread causes an assertion failure
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Keywords: AdobeTracked
          Severity: Normal
          Priority: P2
         Component: CSS
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: stavila at adobe.com
            Blocks: 57312


See attached test-case. 

OUTPUT:

ASSERTION FAILED: m_invalidRegionList.contains(renderNamedFlowFragment)
/Adobe/WebKit/Source/WebCore/rendering/RenderNamedFlowThread.cpp(257) : virtual void WebCore::RenderNamedFlowThread::removeRegionFromThread(WebCore::RenderRegion *)
1   0x108459d50 WTFCrash
2   0x10b49a625 WebCore::RenderNamedFlowThread::removeRegionFromThread(WebCore::RenderRegion*)
3   0x10b4bcf6f WebCore::RenderRegion::detachRegion()
4   0x10b496073 WebCore::RenderNamedFlowFragment::detachRegion()
5   0x10b4bd467 WebCore::RenderRegion::willBeRemovedFromTree()
6   0x10b3839d8 WebCore::RenderElement::removeChildInternal(WebCore::RenderObject&, WebCore::RenderElement::NotifyChildrenType)
7   0x10b3837b2 WebCore::RenderElement::removeChild(WebCore::RenderObject&)
8   0x10b2b6b93 WebCore::RenderBlock::removeChild(WebCore::RenderObject&)
9   0x10b306c1d WebCore::RenderBlockFlow::removeChild(WebCore::RenderObject&)
10  0x10b4aacf6 WebCore::RenderObject::removeFromParent()
11  0x10b4b40e6 WebCore::RenderObject::willBeDestroyed()
12  0x10b385570 WebCore::RenderElement::willBeDestroyed()
13  0x10b45e016 WebCore::RenderLayerModelObject::willBeDestroyed()
14  0x10b34d1f6 WebCore::RenderBoxModelObject::willBeDestroyed()
15  0x10b326d7a WebCore::RenderBox::willBeDestroyed()
16  0x10b2efafc WebCore::RenderBlockFlow::willBeDestroyed()
17  0x10b4b452d WebCore::RenderObject::destroy()
18  0x10b2efb4f WebCore::RenderBlockFlow::setRenderNamedFlowFragment(WebCore::RenderNamedFlowFragment*)
19  0x10b2ef95e WebCore::RenderBlockFlow::willBeDestroyed()
20  0x10b4b452d WebCore::RenderObject::destroy()
21  0x10b4b4502 WebCore::RenderObject::destroyAndCleanupAnonymousWrappers()
22  0x10b847f05 WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType)
23  0x10b849f7a WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType)
24  0x10b847ed9 WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType)
25  0x10b84a176 WebCore::Style::resolveLocal(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change)
26  0x10b847b0b WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change)
27  0x10b847d49 WebCore::Style::resolveTree(WebCore::Element&, WebCore::ContainerNode&, WebCore::Style::RenderTreePosition&, WebCore::Style::Change)
28  0x10b8479b8 WebCore::Style::resolveTree(WebCore::Document&, WebCore::Style::Change)
29  0x10a160c86 WebCore::Document::recalcStyle(WebCore::Style::Change)
30  0x10a15d20f WebCore::Document::updateStyleIfNeeded()
31  0x10a16cf02 WebCore::Document::finishedParsing()

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.