[Webkit-unassigned] [Bug 272127] REGRESSION(277009 at main) fast/text/remove-renderer-and-select-crash.html makes a subsequent test crash: RELEASE_ASSERT(index != notFound) in LayoutIntegration::BoxTree::rendererForLayoutBox

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=272127

--- Comment #2 from Fujii Hironori <Hironori.Fujii at sony.com> ---
With the above patch, stderr has the following message:

ASSERTION FAILED: index != notFound
C:\webkit\Source\WebCore\layout/integration/LayoutIntegrationBoxTree.cpp(389) : rendererForLayoutBox
1   00007FF9B20B1CA9 WTFCrash
2   00007FF988862EFD WTFCrashWithInfo
3   00007FF98BFB2DE0 WebCore::LayoutIntegration::BoxTree::rendererForLayoutBox
4   00007FF98BFB304D WebCore::LayoutIntegration::BoxTree::rendererForLayoutBox
5   00007FF98BFF7DF1 WebCore::LayoutIntegration::LineLayout::rendererForLayoutBox
6   00007FF98BFD9595 WebCore::LayoutIntegration::InlineContent::rendererForLayoutBox
7   00007FF98AAADA0C WebCore::InlineIterator::BoxModernPath::renderer
8   00007FF98AAAD9C8 WebCore::InlineIterator::Box::renderer::<lambda_1>::operator()<const WebCore::InlineIterator::BoxModernPath>
9   00007FF98AAAD96D std::invoke<WTF::Visitor<`lambda at C:\PSDEV\wb\Source\WebCore\layout\integration\inline\InlineIteratorBox.h:229:41'>,const WebCore::InlineIterator::BoxModernPath &>
10  00007FF98AAAD8FD std::_Variant_dispatcher<std::integer_sequence<unsigned long long,1> >::_Dispatch2<const WebCore::RenderObject &,WTF::Visitor<`lambda at C:\PSDEV\wb\Source\WebCore\layout\integration\inline\InlineIteratorBox.h:229:41'>,const std::variant<WebCore::InlineIterator::BoxModernPath,WebCore::InlineIterator::BoxLegacyPath> &,0>
11  00007FF98AAAD843 std::_Visit_strategy<1>::_Visit2<const WebCore::RenderObject &,std::_Meta_list<std::integer_sequence<unsigned long long,0>,std::integer_sequence<unsigned long long,1>,std::integer_sequence<unsigned long long,2> >,WTF::Visitor<`lambda at C:\PSDEV\wb\Source\WebCore\layout\integration\inline\InlineIteratorBox.h:229:41'>,const std::variant<WebCore::InlineIterator::BoxModernPath,WebCore::InlineIterator::BoxLegacyPath> &>
12  00007FF98AAAD7DA std::_Visit_impl<3,const WebCore::RenderObject &,std::_Meta_list<std::integer_sequence<unsigned long long,0>,std::integer_sequence<unsigned long long,1>,std::integer_sequence<unsigned long long,2> >,WTF::Visitor<`lambda at C:\PSDEV\wb\Source\WebCore\layout\integration\inline\InlineIteratorBox.h:229:41'>,const std::variant<WebCore::InlineIterator::BoxModernPath,WebCore::InlineIterator::BoxLegacyPath> &>
13  00007FF98AAAD756 std::visit<WTF::Visitor<`lambda at C:\PSDEV\wb\Source\WebCore\layout\integration\inline\InlineIteratorBox.h:229:41'>,const std::variant<WebCore::InlineIterator::BoxModernPath,WebCore::InlineIterator::BoxLegacyPath> &,void>
14  00007FF98AAAD714 WTF::switchOn<const std::variant<WebCore::InlineIterator::BoxModernPath,WebCore::InlineIterator::BoxLegacyPath> &,`lambda at C:\PSDEV\wb\Source\WebCore\layout\integration\inline\InlineIteratorBox.h:229:41'>
15  00007FF98AA9C1C7 WebCore::InlineIterator::Box::renderer
16  00007FF98CA0E7DA WebCore::RenderBlockFlow::positionForPointWithInlineChildren
17  00007FF98C9EAFB5 WebCore::RenderBlock::positionForPoint
18  00007FF98CA0EE4F WebCore::RenderBlockFlow::positionForPoint
19  00007FF98C9EA876 WebCore::positionForPointRespectingEditingBoundaries
20  00007FF98C9EB325 WebCore::RenderBlock::positionForPoint
21  00007FF98CA0EE4F WebCore::RenderBlockFlow::positionForPoint
22  00007FF98C9EA876 WebCore::positionForPointRespectingEditingBoundaries
23  00007FF98C9EB325 WebCore::RenderBlock::positionForPoint
24  00007FF98CA0EE4F WebCore::RenderBlockFlow::positionForPoint
25  00007FF98B7B4379 WebCore::FrameSelection::contains
26  00007FF98C972199 WebCore::HitTestResult::isSelected
27  00007FF98F7A7B7D WebKit::WebHitTestResultData::WebHitTestResultData
28  00007FF990098A26 WebKit::WebChromeClient::mouseDidMoveOverElement
29  00007FF98C2103CD WebCore::Chrome::mouseDidMoveOverElement
30  00007FF98C267F50 WebCore::EventHandler::mouseMoved
31  00007FF9901DBEE6 WebKit::WebFrame::handleMouseEvent

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20240404/ec2e8612/attachment.htm>