[Webkit-unassigned] [Bug 275103] REGRESSION(279667 at main): ASSERTION FAILED: posChildNeedsLayout() || selfNeedsLayout() || !parent() in WebCore::RenderElement::setOutOfFlowChildNeedsStaticPositionLayout()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=275103

--- Comment #3 from Fujii Hironori <Hironori.Fujii at sony.com> ---
I got another crash just by loading https://mainichi.jp/articles/20240603/k00/00m/040/221000c today with Windows port Debug 279717 at main.

ASSERTION FAILED: posChildNeedsLayout() || selfNeedsLayout() || !parent()
C:\webkit\wb\Source\WebCore\rendering/RenderElement.cpp(1214) : void WebCore::RenderElement::setOutOfFlowChildNeedsStaticPositionLayout()
1   00007FFB18F11CA9 WTFCrash
2   00007FFAE6422EFD WTFCrashWithInfo
3   00007FFAEA97468C WebCore::RenderElement::setOutOfFlowChildNeedsStaticPositionLayout
4   00007FFAEAD02A9E WebCore::RenderTreeBuilder::attachToRenderElementInternal
5   00007FFAEAD00B21 WebCore::RenderTreeBuilder::attachToRenderElement
6   00007FFAEAD010B0 WebCore::RenderTreeBuilder::Block::attachIgnoringContinuation
7   00007FFAEAD00905 WebCore::RenderTreeBuilder::Block::attach
8   00007FFAEAD00717 WebCore::RenderTreeBuilder::BlockFlow::attach
9   00007FFAEACFF89E WebCore::RenderTreeBuilder::attachInternal
10  00007FFAEACFF1A7 WebCore::RenderTreeBuilder::attach
11  00007FFAEAD25CA1 WebCore::RenderTreeUpdater::createRenderer
12  00007FFAEAD23654 WebCore::RenderTreeUpdater::updateElementRenderer
13  00007FFAEAD22A04 WebCore::RenderTreeUpdater::updateRenderTree
14  00007FFAEAD22267 WebCore::RenderTreeUpdater::commit
15  00007FFAE927AA41 WebCore::Document::updateRenderTree
16  00007FFAE927B1ED WebCore::Document::resolveStyle
17  00007FFAE927BA31 WebCore::Document::updateStyleIfNeeded
18  00007FFAE927C5BC WebCore::Document::updateLayoutIfDimensionsOutOfDate
19  00007FFAE927C501 WebCore::Document::updateLayoutIfDimensionsOutOfDate
20  00007FFAE9366AB8 WebCore::Element::scrollHeight
21  00007FFAE6FE9C1A WebCore::jsElement_scrollHeightGetter
22  00007FFAE6FA8C55 WebCore::IDLAttribute<WebCore::JSElement>::get<&WebCore::jsElement_scrollHeightGetter,3>
23  00007FFAE6FA8B10 WebCore::jsElement_scrollHeight
24  00007FFB0992B729 WTF::FunctionPtr<57072,long long (JSC::JSGlobalObject *, long long, JSC::PropertyName),1>::operator()
25  00007FFB09C4B441 JSC::PropertySlot::customGetter
26  00007FFB08DDB748 JSC::PropertySlot::getValue
27  00007FFB08DDAF62 JSC::JSValue::get
28  00007FFB09470B23 JSC::LLInt::performLLIntGetByID
29  00007FFB09470850 llint_slow_path_get_by_id
30  00007FFB08D4C839 llint_entry
31  0000020BB95ECAE0 (null)
Exception thrown at 0x00007FFB18F11CAE (WTF.dll) in WebKitWebProcess.exe: 0xC0000005: Access violation writing location 0x00000000BBADBEEF.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20240604/fff683f3/attachment.htm>