[Webkit-unassigned] [Bug 235568] New: ASSERTION FAILED: m_fragmentedFlow->objectShouldFragmentInFlowFragment(box, this)

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=235568

            Bug ID: 235568
           Summary: ASSERTION FAILED:
                    m_fragmentedFlow->objectShouldFragmentInFlowFragment(b
                    ox, this)
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebCore Misc.
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: alset0326 at gmail.com

Created attachment 449910

  --> https://bugs.webkit.org/attachment.cgi?id=449910&action=review

the html can make crash

1. build a debug webkit
2. open the html
3. crash

ASSERTION FAILED: m_fragmentedFlow->objectShouldFragmentInFlowFragment(box, this)
../../Source/WebCore/rendering/RenderFragmentContainer.cpp(446) : void WebCore::RenderFragmentContainer::ensureOverflowForBox(const WebCore::RenderBox*, WTF::RefPtr<WebCore::RenderOverflow>&, bool)
1   0x7ff308b0c964 WTFReportBacktrace
2   0x7ff308b0cc01 WTFCrash
3   0x7ff322603ba1 WTF::CrashOnOverflow::overflowed()
4   0x7ff32bf89418 WebCore::RenderFragmentContainer::ensureOverflowForBox(WebCore::RenderBox const*, WTF::RefPtr<WebCore::RenderOverflow, WTF::RawPtrTraits<WebCore::RenderOverflow>, WTF::DefaultRefDerefTraits<WebCore::RenderOverflow> >&, bool)
5   0x7ff32bf8a743 WebCore::RenderFragmentContainer::layoutOverflowRectForBox(WebCore::RenderBox const*)
6   0x7ff32bf8ac1d WebCore::RenderFragmentContainer::layoutOverflowRectForBoxForPropagation(WebCore::RenderBox const*)
7   0x7ff32bf9a79b WebCore::RenderFragmentedFlow::addFragmentsOverflowFromChild(WebCore::RenderBox const*, WebCore::RenderBox const*, WebCore::LayoutSize const&)
8   0x7ff32be8a092 WebCore::RenderBox::addOverflowFromChild(WebCore::RenderBox const*, WebCore::LayoutSize const&)
9   0x7ff32bd3f1ab WebCore::RenderBlock::addOverflowFromPositionedObjects()
10  0x7ff32bd3e5fa WebCore::RenderBlock::computeOverflow(WebCore::LayoutUnit, bool)
11  0x7ff32be28891 WebCore::RenderBlockFlow::computeOverflow(WebCore::LayoutUnit, bool)
12  0x7ff32be14b6e WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
13  0x7ff32be3e20e WebCore::RenderBlockFlow::relayoutForPagination()
14  0x7ff32be1431e WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
15  0x7ff32bd3d8ab WebCore::RenderBlock::layout()
16  0x7ff32be16a40 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
17  0x7ff32be15c96 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)
18  0x7ff32be13fa4 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
19  0x7ff32bd3d8ab WebCore::RenderBlock::layout()
20  0x7ff32bc80e9e WebCore::RenderElement::layoutIfNeeded()
21  0x7ff32bc659be WebCore::GridTrackSizingAlgorithmStrategy::logicalHeightForChild(WebCore::RenderBox&) const
22  0x7ff32bc65ffd WebCore::GridTrackSizingAlgorithmStrategy::minContentForChild(WebCore::RenderBox&) const
23  0x7ff32bc66921 WebCore::GridTrackSizingAlgorithmStrategy::minSizeForChild(WebCore::RenderBox&) const
24  0x7ff32bc60097 WebCore::GridTrackSizingAlgorithm::sizeTrackToFitNonSpanningItem(WebCore::GridSpan const&, WebCore::RenderBox&, WebCore::GridTrack&)
25  0x7ff32bc6cf5a WebCore::GridTrackSizingAlgorithm::resolveIntrinsicTrackSizes()
26  0x7ff32bc6fafe WebCore::GridTrackSizingAlgorithm::run()
27  0x7ff32bfddf81 WebCore::RenderGrid::computeTrackSizesForIndefiniteSize(WebCore::GridTrackSizingAlgorithm&, WebCore::GridTrackSizingDirection, WebCore::LayoutUnit*, WebCore::LayoutUnit*) const
28  0x7ff32bfdbcba WebCore::RenderGrid::layoutBlock(bool, WebCore::LayoutUnit)
29  0x7ff32bd3d8ab WebCore::RenderBlock::layout()
30  0x7ff32bc80e9e WebCore::RenderElement::layoutIfNeeded()
31  0x7ff32bd1b8b4 WebCore::LegacyLineLayout::layoutLineBoxes(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220125/d5c1f8f4/attachment.htm>