[Webkit-unassigned] [Bug 180896] New: ASSERTION FAILED: !m_current in WebCore::RenderTreeBuilder::RenderTreeBuilder()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=180896

            Bug ID: 180896
           Summary: ASSERTION FAILED: !m_current in
                    WebCore::RenderTreeBuilder::RenderTreeBuilder()
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: ryanhaddad at apple.com
                CC: bfulgham at webkit.org, simon.fraser at apple.com,
                    zalan at apple.com

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore            0x00000001109ef744 WTFCrash + 36 (Assertions.cpp:272)
1   com.apple.WebCore                   0x000000011da9ff96 WebCore::RenderTreeBuilder::RenderTreeBuilder() + 70 (RenderTreeBuilder.cpp:42)
2   com.apple.WebCore                   0x000000011da9ffc5 WebCore::RenderTreeBuilder::RenderTreeBuilder() + 21 (RenderTreeBuilder.cpp:44)
3   com.apple.WebCore                   0x000000011dc5e618 WebCore::RenderTreeUpdater::tearDownRenderers(WebCore::Element&) + 24 (RenderTreeUpdater.cpp:519)
4   com.apple.WebCore                   0x000000011c901f5c WebCore::Document::destroyRenderTree() + 540 (Document.cpp:2307)
5   com.apple.WebCore                   0x000000011c90239d WebCore::Document::prepareForDestruction() + 557 (Document.cpp:2366)
6   com.apple.WebCore                   0x000000011d1730f0 WebCore::Frame::setView(WTF::RefPtr<WebCore::FrameView>&&) + 192 (Frame.cpp:257)
7   com.apple.WebCore                   0x000000011cff0a42 WebCore::FrameLoader::detachFromParent() + 546 (FrameLoader.cpp:2582)
8   com.apple.WebCore                   0x000000011cff0e98 WebCore::FrameLoader::frameDetached() + 104 (FrameLoader.cpp:2553)
9   com.apple.WebCore                   0x000000011ddd3a98 WebCore::SVGImage::~SVGImage() + 552 (SVGImage.cpp:80)
10  com.apple.WebCore                   0x000000011ddd3e95 WebCore::SVGImage::~SVGImage() + 21 (SVGImage.cpp:85)
11  com.apple.WebCore                   0x000000011ddd3eb9 WebCore::SVGImage::~SVGImage() + 25 (SVGImage.cpp:76)
12  com.apple.WebCore                   0x000000011b04801f WTF::RefCounted<WebCore::Image>::deref() const + 79 (RefCounted.h:145)
13  com.apple.WebCore                   0x000000011b047fc5 void WTF::derefIfNotNull<WebCore::Image>(WebCore::Image*) + 53 (RefPtr.h:46)
14  com.apple.WebCore                   0x000000011cc1bfcb WTF::RefPtr<WebCore::Image>::operator=(std::nullptr_t) + 91 (RefPtr.h:152)
15  com.apple.WebCore                   0x000000011d0b217b WebCore::CachedImage::clearImage() + 347 (CachedImage.cpp:421)
16  com.apple.WebCore                   0x000000011d0b1f0a WebCore::CachedImage::~CachedImage() + 42 (CachedImage.cpp:86)
17  com.apple.WebCore                   0x000000011d0b2225 WebCore::CachedImage::~CachedImage() + 21 (CachedImage.cpp:86)
18  com.apple.WebCore                   0x000000011d0b2249 WebCore::CachedImage::~CachedImage() + 25 (CachedImage.cpp:84)
19  com.apple.WebCore                   0x000000011d0bb63b WebCore::CachedResource::deleteIfPossible() + 91 (CachedResource.cpp:605)
20  com.apple.WebCore                   0x000000011d0bd0e6 WebCore::CachedResource::unregisterHandle(WebCore::CachedResourceHandleBase*) + 166 

Seen here with LayoutTest fast/shapes/shape-outside-floats/shape-outside-floats-image-threshold-002.html
https://build.webkit.org/results/Apple%20Sierra%20Debug%20WK1%20(Tests)/r225971%20(5322)/results.html

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20171216/ec0e0d7e/attachment.html>