[Webkit-unassigned] [Bug 133013] New: ASSERTION FAILURE: m_next is nullptr in LayoutState::LayoutState(std::unique_ptr<LayoutState>, ...)

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=133013

           Summary: ASSERTION FAILURE: m_next is nullptr in
                    LayoutState::LayoutState(std::unique_ptr<LayoutState>,
                    ...)
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: dbates at webkit.org
                CC: hyatt at apple.com


Assuming frame flattening is enabled. Consider a page with the following markup:

<div id="test-container" style="display: -webkit-flex; -webkit-flex-direction: column; height: 512px;">
    <iframe style="width: 100%; overflow: hidden" height="0" srcdoc="
        <div style='display: -webkit-flex; -webkit-flex-direction: column; height: 128px; width: 128px; background-color: blue'>
            <div id='scrollableDiv' style='display: none; overflow-y: scroll; width: 100px;'></div>
        </div>
        <script>
        window.setTimeout(function () {
            var scrollableDiv = document.getElementById('scrollableDiv');
            scrollableDiv.innerHTML = 'Supercalifragilisticexpialidocious'; /* A string that cannot be word-wrapped and exceeds the width of the scrollableDiv. */
            scrollableDiv.style.display = 'block';
        }, 0);
        </script>
    "></iframe>
</div>

Then the assertion ASSERT(m_next) fails in LayoutState::LayoutState(std::unique_ptr<LayoutState>, ...).

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.