[Webkit-unassigned] [Bug 151605] ASSERTION FAILED: !newRelayoutRoot.container() || !newRelayoutRoot.container()->needsLayout() in WebCore::FrameView::scheduleRelayoutOfSubtree

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=151605

--- Comment #1 from zalan <zalan at apple.com> ---
B--AG-L- --* RenderView  (0.00, 0.00) (1323.00, 720.00) renderer->(0x11ad6c2c0)
B-----L- --    HTML RenderFlexibleBox  (0.00, 0.00) (0.00, 736.00) renderer->(0x11adf7578) node->(0x11adf1410)
B-O---L- --      HEAD RenderFlexibleBox  (0.00, 0.00) (0.00, 736.00) renderer->(0x11adf7640) node->(0x11adf1478)
B-O---L- --        STYLE RenderFlexibleBox  (0.00, 0.00) (0.00, 736.00) renderer->(0x11adf7708) node->(0x11adec7b8)
B--AG--- --          RenderBlock  (0.00, 0.00) (80.86, 736.00) renderer->(0x11adee450)
I------- --            #text RenderText renderer->(0x11ad955a0) node->(0x11adf2500) length->(153) "\n* {\n    -webkit-columns: 55px 87;\n    overflow-y: scroll;\n    -webkit-backg"...
B-O---L- DN-      BODY RenderFlexibleBox  (8.00, 8.00) (0.00, 704.00) renderer->(0x11adf77d0) node->(0x11adf1548)
B-O---L- --        SUMMARY RenderBlock  (0.00, 0.00) (0.00, 704.00) renderer->(0x11adee508) node->(0x11adf15b0)
B--AG-L- --          RenderMultiColumnFlowThread  (0.00, 0.00) (0.00, 16.00) renderer->(0x11ad29000) [Rs:0x11ad25640 Re:0x11ad25640]
B-O---L- --            PROGRESS RenderFlexibleBox  (0.00, 0.00) (0.00, 16.00) renderer->(0x11adf7898) node->(0x11adf0620) [Rs:0x11ad25640 Re:0x11ad25640]
B------- --              DIV RenderProgress  (0.00, 0.00) (0.00, 16.00) renderer->(0x11ad1b000) node->(0x11adf16e8) [Rs:0x11ad25640 Re:0x11ad25640]
B------- --                DIV RenderBlock  (0.00, 0.00) (0.00, 16.00) renderer->(0x11adee5c0) node->(0x11adf1750) [Rs:0x11ad25640 Re:0x11ad25640]
B------- --                  DIV RenderBlock  (0.00, 0.00) (0.00, 16.00) renderer->(0x11adee678) node->(0x11adf17b8) [Rs:0x11ad25640 Re:0x11ad25640]
B--AG--- --          RenderMultiColumnSet  (0.00, 0.00) (0.00, 16.00) renderer->(0x11ad25640)
B-O---L- --        SCRIPT RenderFlexibleBox  (0.00, 0.00) (0.00, 704.00) renderer->(0x11adf7960) node->(0x11adecb48)
B--AG--- --          RenderBlock  (0.00, 0.00) (314.97, 704.00) renderer->(0x11adee730)
I------- --            #text RenderText renderer->(0x11ad95e40) node->(0x11adf25f0) length->(192) "\nsetTimeout(function() {\n    window.scrollTo(0,document.body.scrollHeight);\n "...

BODY is stuck with dirty layout flag.
When a descendant renderer is being removed, we try to ensures it is no longer a layoutroot by marking its ancestors dirty (and ofc the ancestor tree needs to know about this change in order to layout/repaint properly).
However since BODY is already dirty, we end up not scheduling a new layout (and we don't change the layout root either) -> ASSERT.
BODY is marked dirty while finishing up the layout on HTML. During post layout, we start updating the scrollbars for overflow content. SUMMARY is a candidate and while we try to contain the layout by marking only the current renderer (MarkThisOnly) before calling current.layoutBlock(), the RenderMultiColumnSet child ends up setting the dirty flag on the ancestors (including BODY). However no one issues layout on the BODY at this point.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160114/395c14f7/attachment-0001.html>