[Webkit-unassigned] [Bug 155702] New: ASSERTION FAILED: hasOverflowingCell == this->hasOverflowingCell() in WebCore::RenderTableSection::computeOverflowFromCells

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=155702

            Bug ID: 155702
           Summary: ASSERTION FAILED: hasOverflowingCell ==
                    this->hasOverflowingCell() in
                    WebCore::RenderTableSection::computeOverflowFromCells
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: rhodovan.u-szeged at partner.samsung.com
                CC: akling at apple.com, mitz at webkit.org,
                    simon.fraser at apple.com
            Blocks: 116980

Created attachment 274545
  --> https://bugs.webkit.org/attachment.cgi?id=274545&action=review
Test case

Load the attached test with minibrowser:

<script>
window.onload = function() {
    window.scrollTo(0,document.body.scrollHeight);
    document.designMode = 'on';
    var parent = document.getElementById('foo');
    parent.removeChild(parent.childNodes[0]);

}
</script>
<style>
* {
    margin-top: -47%;
    text-emphasis-position: under right;
    position: relative;
    display: inline-table;
}
ins {
    position: absolute;
    text-emphasis-style: filled;
}
</style>
<li></li>
<table>
    <th>
        <ins><h3><pre><a>a<pre><ins><details></details></ins></pre></a></pre></h3></ins>
    </th>
</table>


OS: Ubuntu 15.10, x86_64  (also validated on Mac OS X 10.11.1 (x86_64), x86_64)
Checked build: debug EFL (and MAC)
Checked version: d5bbb4a


Backtrace:

ASSERTION FAILED: hasOverflowingCell == this->hasOverflowingCell()
../../Source/WebCore/rendering/RenderTableSection.cpp(712) : void WebCore::RenderTableSection::computeOverflowFromCells(unsigned int, unsigned int)
1   0x7fa4948e83a6 WTFCrash
2   0x7fa493896f75 WebCore::RenderTableSection::computeOverflowFromCells(unsigned int, unsigned int)
3   0x7fa493896d1e WebCore::RenderTableSection::computeOverflowFromCells()
4   0x7fa49387b031 WebCore::RenderTable::simplifiedNormalFlowLayout()
5   0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout()
6   0x7fa49387b0d0 WebCore::RenderTable::layout()
7   0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
8   0x7fa4936b10dc WebCore::RenderBlock::simplifiedNormalFlowLayout()
9   0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout()
10  0x7fa4936dead5 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
11  0x7fa493889680 WebCore::RenderTableCell::layout()
12  0x7fa493892e46 WebCore::RenderTableRow::layout()
13  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
14  0x7fa493895569 WebCore::RenderTableSection::layout()
15  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
16  0x7fa49387b537 WebCore::RenderTable::layout()
17  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
18  0x7fa4937053fe WebCore::RenderBlockFlow::layoutLineBoxes(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
19  0x7fa4936dfa97 WebCore::RenderBlockFlow::layoutInlineChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
20  0x7fa4936dee10 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
21  0x7fa493889680 WebCore::RenderTableCell::layout()
22  0x7fa493892e46 WebCore::RenderTableRow::layout()
23  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
24  0x7fa493895569 WebCore::RenderTableSection::layout()
25  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
26  0x7fa49387b025 WebCore::RenderTable::simplifiedNormalFlowLayout()
27  0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout()
28  0x7fa49387b0d0 WebCore::RenderTable::layout()
29  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
30  0x7fa4936b10dc WebCore::RenderBlock::simplifiedNormalFlowLayout()
31  0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout()

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160320/0b0ecbc3/attachment-0001.html>