[Webkit-unassigned] [Bug 151105] [GTK] ASSERTION FAILED: totalFlexGrow >= 0 && totalWeightedFlexShrink >= 0 in WebCore::RenderFlexibleBox::layoutFlexItems

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=151105

--- Comment #5 from Renata Hodovan <hodovan at inf.u-szeged.hu> ---
(In reply to Frédéric Wang (:fredw) from comment #4)
> @Renata: I'm not able to reproduce the issue. I tried with debug build of
> WebKitGTK (r224920) and macOS (r224757).

@Frédéric: Indeed, the issue is quite old (the assertion doesn't even exist in this form). However, I have a repro that triggers the new assertion check both with WebKitGTK (r224529) and macOS (r225029): 

ASSERTION FAILED: totalFlexGrow >= 0
../../Source/WebCore/rendering/RenderFlexibleBox.cpp(888) : void WebCore::RenderFlexibleBox::layoutFlexItems(bool)

Test case:

<style>
metadata {
    flex-grow: 615112881120490770;
}

tspan {
    display: flex
}

* { 
    flex-grow: 27306422;
    margin: 018ch;
    display: inline-grid,
    overflow-y: overlay
}
</style>
<tspan>
    <metadata>a</metadata>
    <div>a</div>
</tspan>


Could you verify it, please?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20171121/991e3ce3/attachment-0001.html>