[Webkit-unassigned] [Bug 130352] New: ASSERTION FAILED: (!child->renderer() || child->inNamedFlow()) || current.shadowRoot() in WebCore::Style::attachChildren
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Mon Mar 17 11:46:26 PDT 2014
https://bugs.webkit.org/show_bug.cgi?id=130352
Summary: ASSERTION FAILED: (!child->renderer() ||
child->inNamedFlow()) || current.shadowRoot() in
WebCore::Style::attachChildren
Product: WebKit
Version: 528+ (Nightly build)
Platform: Unspecified
OS/Version: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: CSS
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: rhodovan.u-szeged at partner.samsung.com
CC: koivisto at iki.fi, akling at apple.com
Blocks: 116980
Created an attachment (id=226943)
--> (https://bugs.webkit.org/attachment.cgi?id=226943&action=review)
Test case
The test evoking the above assertion does not make too much sense but it reproduces the crash with 100% certainty. Since the test contains many filling 'A' characters, I don't paste it here but you can find it in the attachment.
Backtrace:
ASSERTION FAILED: (!child->renderer() || child->inNamedFlow()) || current.shadowRoot()
/home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp(435) : void WebCore::Style::attachChildren(WebCore::ContainerNode&, WebCore::ContainerNode&)
1 0x7ffff5ed5075 WTFCrash
2 0x7ffff1a83541
3 0x7ffff1a8373d
4 0x7ffff1a83c3c
5 0x7ffff1a84314
6 0x7ffff1a848b1
7 0x7ffff1a846be
8 0x7ffff1a8493d
9 0x7ffff1a84a71
10 0x7ffff1a84a71
11 0x7ffff1a84d08 WebCore::Style::resolveTree(WebCore::Document&, WebCore::Style::Change)
12 0x7ffff0f7bea4 WebCore::Document::recalcStyle(WebCore::Style::Change)
13 0x7ffff0f7c159 WebCore::Document::updateStyleIfNeeded()
14 0x7ffff0f7c257 WebCore::Document::updateLayout()
15 0x7ffff18d0e96 WebCore::RenderLayer::hitTest(WebCore::HitTestRequest const&, WebCore::HitTestLocation const&, WebCore::HitTestResult&)
16 0x7ffff1994988 WebCore::RenderView::hitTest(WebCore::HitTestRequest const&, WebCore::HitTestLocation const&, WebCore::HitTestResult&)
17 0x7ffff199494d WebCore::RenderView::hitTest(WebCore::HitTestRequest const&, WebCore::HitTestResult&)
18 0x7ffff0f804d1 WebCore::Document::prepareMouseEvent(WebCore::HitTestRequest const&, WebCore::LayoutPoint const&, WebCore::PlatformMouseEvent const&)
19 0x7ffff14ff2f4 WebCore::EventHandler::prepareMouseEvent(WebCore::HitTestRequest const&, WebCore::PlatformMouseEvent const&)
20 0x7ffff14fd330 WebCore::EventHandler::handleMouseMoveEvent(WebCore::PlatformMouseEvent const&, WebCore::HitTestResult*, bool)
21 0x7ffff14fce57 WebCore::EventHandler::mouseMoved(WebCore::PlatformMouseEvent const&)
22 0x7ffff7b48056 ewk_frame_feed_mouse_move
23 0x7ffff7b5cbef
24 0x7ffff7b5d5c5
25 0x7ffff6ca7272 evas_object_event_callback_call
26 0x7ffff6ca73b9 evas_object_event_callback_call
27 0x7ffff6cab382
28 0x7fffeb98fc36 ecore_event_evas_mouse_move
29 0x7ffff78d50e7 _ecore_event_call
30 0x7ffff78d9479
31 0x7ffff78d99c7 ecore_main_loop_begin
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff5ed507a in WTFCrash () at /home/reni2/data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333
333 *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt
#0 0x00007ffff5ed507a in WTFCrash () at /home/reni2/data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333
#1 0x00007ffff1a83541 in WebCore::Style::attachChildren (current=..., renderingParentNode=...)
at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:435
#2 0x00007ffff1a8373d in WebCore::Style::attachDistributedChildren (insertionPoint=..., renderingParentNode=...)
at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:468
#3 0x00007ffff1a83c3c in WebCore::Style::attachRenderTree (current=..., renderingParentNode=..., resolvedStyle=...)
at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:553
#4 0x00007ffff1a84314 in WebCore::Style::resolveLocal (current=..., renderingParentNode=..., inheritedChange=WebCore::Style::Force)
at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:679
#5 0x00007ffff1a848b1 in WebCore::Style::resolveTree (current=..., renderingParentNode=..., change=WebCore::Style::Force)
at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:826
#6 0x00007ffff1a846be in WebCore::Style::resolveShadowTree (shadowRoot=..., change=WebCore::Style::Force)
at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:734
#7 0x00007ffff1a8493d in WebCore::Style::resolveTree (current=..., renderingParentNode=..., change=WebCore::Style::Force)
at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:834
#8 0x00007ffff1a84a71 in WebCore::Style::resolveTree (current=..., renderingParentNode=..., change=WebCore::Style::Force)
at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:858
#9 0x00007ffff1a84a71 in WebCore::Style::resolveTree (current=..., renderingParentNode=..., change=WebCore::Style::Force)
at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:858
#10 0x00007ffff1a84d08 in WebCore::Style::resolveTree (document=..., change=WebCore::Style::Force)
at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:899
#11 0x00007ffff0f7bea4 in WebCore::Document::recalcStyle (this=0x74f390, change=WebCore::Style::Force)
at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:1770
#12 0x00007ffff0f7c159 in WebCore::Document::updateStyleIfNeeded (this=0x74f390)
at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:1818
#13 0x00007ffff0f7c257 in WebCore::Document::updateLayout (this=0x74f390) at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:1837
#14 0x00007ffff18d0e96 in WebCore::RenderLayer::hitTest (this=0x9e2b70, request=..., hitTestLocation=..., result=...)
at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/rendering/RenderLayer.cpp:4594
#15 0x00007ffff1994988 in WebCore::RenderView::hitTest (this=0x8a68d0, request=..., location=..., result=...)
at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/rendering/RenderView.cpp:101
#16 0x00007ffff199494d in WebCore::RenderView::hitTest (this=0x8a68d0, request=..., result=...)
at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/rendering/RenderView.cpp:96
#17 0x00007ffff0f804d1 in WebCore::Document::prepareMouseEvent (this=0x74f390, request=..., documentPoint=..., event=...)
at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:3008
#18 0x00007ffff14ff2f4 in WebCore::EventHandler::prepareMouseEvent (this=0x77daf0, request=..., mev=...)
at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/page/EventHandler.cpp:2258
#19 0x00007ffff14fd330 in WebCore::EventHandler::handleMouseMoveEvent (this=0x77daf0, mouseEvent=..., hoveredNode=0x7fffffffc450,
onlyUpdateScrollbars=false) at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/page/EventHandler.cpp:1820
#20 0x00007ffff14fce57 in WebCore::EventHandler::mouseMoved (this=0x77daf0, event=...)
at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/page/EventHandler.cpp:1737
#21 0x00007ffff7b48056 in ewk_frame_feed_mouse_move (ewkFrame=0x775570, moveEvent=0x7fffffffc7e0)
at /home/reni2/data/REPOS/webkit_sec/Source/WebKit/efl/ewk/ewk_frame.cpp:953
#22 0x00007ffff7b5cbef in _ewk_view_smart_mouse_move (smartData=0x943930, moveEvent=0x7fffffffc7e0)
at /home/reni2/data/REPOS/webkit_sec/Source/WebKit/efl/ewk/ewk_view.cpp:521
#23 0x00007ffff7b5d5c5 in _ewk_view_on_mouse_move (data=0x943930, eventInfo=0x7fffffffc7e0)
at /home/reni2/data/REPOS/webkit_sec/Source/WebKit/efl/ewk/ewk_view.cpp:637
#24 0x00007ffff6ca7272 in evas_object_event_callback_call (obj=0x774db0, type=type at entry=EVAS_CALLBACK_MOUSE_MOVE,
event_info=event_info at entry=0x7fffffffc7e0, event_id=event_id at entry=486) at evas_callbacks.c:232
#25 0x00007ffff6ca73b9 in evas_object_event_callback_call (obj=obj at entry=0x775380, type=type at entry=EVAS_CALLBACK_MOUSE_MOVE,
event_info=event_info at entry=0x7fffffffc7e0, event_id=event_id at entry=486) at evas_callbacks.c:261
#26 0x00007ffff6cab382 in evas_event_feed_mouse_move (e=0x8a9210, x=536, y=547, timestamp=<optimized out>, data=<optimized out>) at evas_events.c:836
#27 0x00007fffeb98fc36 in ecore_event_evas_mouse_move (data=<optimized out>, type=<optimized out>, event=0xf914a0) at ecore_input_evas.c:238
#28 0x00007ffff78d50e7 in _ecore_call_handler_cb (event=<optimized out>, type=<optimized out>, data=<optimized out>, func=<optimized out>)
at ecore_private.h:321
#29 _ecore_event_call () at ecore_events.c:559
---Type <return> to continue, or q <return> to quit---
#30 0x00007ffff78d9479 in _ecore_main_loop_iterate_internal (once_only=once_only at entry=0) at ecore_main.c:1922
#31 0x00007ffff78d99c7 in ecore_main_loop_begin () at ecore_main.c:956
#32 0x0000000000406866 in main (argc=2, argv=0x7fffffffda98) at /home/reni2/data/REPOS/webkit_sec/Tools/EWebLauncher/main.c:1002
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list