[Webkit-unassigned] [Bug 262245] New: ASSERTION FAILED: m_accumulatedOffsetMightBeSaturated || areEssentiallyEqual(rendererMappedResult, result)

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=262245

            Bug ID: 262245
           Summary: ASSERTION FAILED: m_accumulatedOffsetMightBeSaturated
                    || areEssentiallyEqual(rendererMappedResult, result)
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: 1319794503 at qq.com
                CC: bfulgham at webkit.org, simon.fraser at apple.com,
                    zalan at apple.com

Created attachment 467921

  --> https://bugs.webkit.org/attachment.cgi?id=467921&action=review

testcase to trigger the crash

Webkit Version: webkitgtk 2.42.0 with asan and debug.

ASSERTION FAILED: m_accumulatedOffsetMightBeSaturated || areEssentiallyEqual(rendererMappedResult, result)
/app/webkit/Source/WebCore/rendering/RenderGeometryMap.cpp(116) : WebCore::FloatPoint WebCore::RenderGeometryMap::mapToContainer(const WebCore::FloatPoint&, const WebCore::RenderLayerModelObject*) const
1   0x7f9dc47873f3 WTFCrash
2   0x7f9dce849da9 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0x8d5eda9) [0x7f9dce849da9]
3   0x7f9dd4c23625 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf138625) [0x7f9dd4c23625]
4   0x7f9dd4ca5586 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf1ba586) [0x7f9dd4ca5586]
5   0x7f9dd4c56875 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf16b875) [0x7f9dd4c56875]
6   0x7f9dd4c57012 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf16c012) [0x7f9dd4c57012]
7   0x7f9dd4c57012 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf16c012) [0x7f9dd4c57012]
8   0x7f9dd4c57012 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf16c012) [0x7f9dd4c57012]
9   0x7f9dd4c57012 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf16c012) [0x7f9dd4c57012]
10  0x7f9dd4c566ef /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf16b6ef) [0x7f9dd4c566ef]
11  0x7f9dd40ebeb3 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe600eb3) [0x7f9dd40ebeb3]
12  0x7f9dd4104f4a /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe619f4a) [0x7f9dd4104f4a]
13  0x7f9dd41040f7 WebCore::LocalFrameViewLayoutContext::layout()
14  0x7f9dd4105fd1 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe61afd1) [0x7f9dd4105fd1]
15  0x7f9dd413f4e4 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe6544e4) [0x7f9dd413f4e4]
16  0x7f9dd413f3d5 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe6543d5) [0x7f9dd413f3d5]
17  0x7f9dd413f2dd /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe6542dd) [0x7f9dd413f2dd]
18  0x7f9dd413f225 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe654225) [0x7f9dd413f225]
19  0x7f9dd413f1ce /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe6541ce) [0x7f9dd413f1ce]
20  0x7f9dcf123f47 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0x9638f47) [0x7f9dcf123f47]
21  0x7f9dcf22f1ae /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0x97441ae) [0x7f9dcf22f1ae]
22  0x7f9dd43b24c4 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe8c74c4) [0x7f9dd43b24c4]
23  0x7f9dd43b1db5 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe8c6db5) [0x7f9dd43b1db5]
24  0x7f9dd43b527a /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe8ca27a) [0x7f9dd43b527a]
25  0x7f9dcf123f47 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0x9638f47) [0x7f9dcf123f47]
26  0x7f9dd435a640 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe86f640) [0x7f9dd435a640]
27  0x7f9dd4360a28 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe875a28) [0x7f9dd4360a28]
28  0x7f9dd43609a1 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe8759a1) [0x7f9dd43609a1]
29  0x7f9dd4360917 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe875917) [0x7f9dd4360917]
30  0x7f9dd43608a9 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe8758a9) [0x7f9dd43608a9]
31  0x7f9dd4360872 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe875872) [0x7f9dd4360872]

** (MiniBrowser:17): WARNING **: 04:30:36.417: WebProcess CRASHED

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20230928/84524108/attachment-0001.htm>