[Webkit-unassigned] [Bug 262268] New: ASSERTION FAILED: newFloatItem.layoutBox() => m_floats.findIf([&] (auto& entry) { return entry.layoutBox() == newFloatItem.layoutBox(); }) == notFound

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=262268

            Bug ID: 262268
           Summary: ASSERTION FAILED: newFloatItem.layoutBox() =>
                    m_floats.findIf([&] (auto& entry) { return
                    entry.layoutBox() == newFloatItem.layoutBox(); }) ==
                    notFound
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: 1319794503 at qq.com
                CC: bfulgham at webkit.org, simon.fraser at apple.com,
                    zalan at apple.com

Created attachment 467941

  --> https://bugs.webkit.org/attachment.cgi?id=467941&action=review

testcase to trigger the crash

ASSERTION FAILED: newFloatItem.layoutBox() => m_floats.findIf([&] (auto& entry) { return entry.layoutBox() == newFloatItem.layoutBox(); }) == notFound
/app/webkit/Source/WebCore/layout/floats/FloatingState.cpp(82) : void WebCore::Layout::FloatingState::append(FloatItem)

The minimized testcase will be uploaded as soon as possilble.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20230928/e1c05830/attachment-0001.htm>