<html>
    <head>
      <base href="https://bugs.webkit.org/" />
    </head>
    <body><table border="1" cellspacing="0" cellpadding="8">
        <tr>
          <th>Bug ID</th>
          <td><a class="bz_bug_link 
          bz_status_NEW "
   title="NEW - ASSERTION FAILED: hasOverflowingCell == this-&gt;hasOverflowingCell() in WebCore::RenderTableSection::computeOverflowFromCells"
   href="https://bugs.webkit.org/show_bug.cgi?id=155702">155702</a>
          </td>
        </tr>

        <tr>
          <th>Summary</th>
          <td>ASSERTION FAILED: hasOverflowingCell == this-&gt;hasOverflowingCell() in WebCore::RenderTableSection::computeOverflowFromCells
          </td>
        </tr>

        <tr>
          <th>Classification</th>
          <td>Unclassified
          </td>
        </tr>

        <tr>
          <th>Product</th>
          <td>WebKit
          </td>
        </tr>

        <tr>
          <th>Version</th>
          <td>WebKit Nightly Build
          </td>
        </tr>

        <tr>
          <th>Hardware</th>
          <td>Unspecified
          </td>
        </tr>

        <tr>
          <th>OS</th>
          <td>Unspecified
          </td>
        </tr>

        <tr>
          <th>Status</th>
          <td>NEW
          </td>
        </tr>

        <tr>
          <th>Severity</th>
          <td>Normal
          </td>
        </tr>

        <tr>
          <th>Priority</th>
          <td>P2
          </td>
        </tr>

        <tr>
          <th>Component</th>
          <td>Layout and Rendering
          </td>
        </tr>

        <tr>
          <th>Assignee</th>
          <td>webkit-unassigned&#64;lists.webkit.org
          </td>
        </tr>

        <tr>
          <th>Reporter</th>
          <td>rhodovan.u-szeged&#64;partner.samsung.com
          </td>
        </tr>

        <tr>
          <th>CC</th>
          <td>akling&#64;apple.com, mitz&#64;webkit.org, simon.fraser&#64;apple.com
          </td>
        </tr>

        <tr>
          <th>Blocks</th>
          <td>116980
          </td>
        </tr></table>
      <p>
        <div>
        <pre>Created <span class=""><a href="attachment.cgi?id=274545" name="attach_274545" title="Test case">attachment 274545</a> <a href="attachment.cgi?id=274545&amp;action=edit" title="Test case">[details]</a></span>
Test case

Load the attached test with minibrowser:

&lt;script&gt;
window.onload = function() {
    window.scrollTo(0,document.body.scrollHeight);
    document.designMode = 'on';
    var parent = document.getElementById('foo');
    parent.removeChild(parent.childNodes[0]);

}
&lt;/script&gt;
&lt;style&gt;
* {
    margin-top: -47%;
    text-emphasis-position: under right;
    position: relative;
    display: inline-table;
}
ins {
    position: absolute;
    text-emphasis-style: filled;
}
&lt;/style&gt;
&lt;li&gt;&lt;/li&gt;
&lt;table&gt;
    &lt;th&gt;
        &lt;ins&gt;&lt;h3&gt;&lt;pre&gt;&lt;a&gt;a&lt;pre&gt;&lt;ins&gt;&lt;details&gt;&lt;/details&gt;&lt;/ins&gt;&lt;/pre&gt;&lt;/a&gt;&lt;/pre&gt;&lt;/h3&gt;&lt;/ins&gt;
    &lt;/th&gt;
&lt;/table&gt;


OS: Ubuntu 15.10, x86_64  (also validated on Mac OS X 10.11.1 (x86_64), x86_64)
Checked build: debug EFL (and MAC)
Checked version: d5bbb4a


Backtrace:

ASSERTION FAILED: hasOverflowingCell == this-&gt;hasOverflowingCell()
../../Source/WebCore/rendering/RenderTableSection.cpp(712) : void WebCore::RenderTableSection::computeOverflowFromCells(unsigned int, unsigned int)
1   0x7fa4948e83a6 WTFCrash
2   0x7fa493896f75 WebCore::RenderTableSection::computeOverflowFromCells(unsigned int, unsigned int)
3   0x7fa493896d1e WebCore::RenderTableSection::computeOverflowFromCells()
4   0x7fa49387b031 WebCore::RenderTable::simplifiedNormalFlowLayout()
5   0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout()
6   0x7fa49387b0d0 WebCore::RenderTable::layout()
7   0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
8   0x7fa4936b10dc WebCore::RenderBlock::simplifiedNormalFlowLayout()
9   0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout()
10  0x7fa4936dead5 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
11  0x7fa493889680 WebCore::RenderTableCell::layout()
12  0x7fa493892e46 WebCore::RenderTableRow::layout()
13  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
14  0x7fa493895569 WebCore::RenderTableSection::layout()
15  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
16  0x7fa49387b537 WebCore::RenderTable::layout()
17  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
18  0x7fa4937053fe WebCore::RenderBlockFlow::layoutLineBoxes(bool, WebCore::LayoutUnit&amp;, WebCore::LayoutUnit&amp;)
19  0x7fa4936dfa97 WebCore::RenderBlockFlow::layoutInlineChildren(bool, WebCore::LayoutUnit&amp;, WebCore::LayoutUnit&amp;)
20  0x7fa4936dee10 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
21  0x7fa493889680 WebCore::RenderTableCell::layout()
22  0x7fa493892e46 WebCore::RenderTableRow::layout()
23  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
24  0x7fa493895569 WebCore::RenderTableSection::layout()
25  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
26  0x7fa49387b025 WebCore::RenderTable::simplifiedNormalFlowLayout()
27  0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout()
28  0x7fa49387b0d0 WebCore::RenderTable::layout()
29  0x7fa493686eb5 WebCore::RenderElement::layoutIfNeeded()
30  0x7fa4936b10dc WebCore::RenderBlock::simplifiedNormalFlowLayout()
31  0x7fa4936b14ba WebCore::RenderBlock::simplifiedLayout()</pre>
        </div>
      </p>
      <hr>
      <span>You are receiving this mail because:</span>
      
      <ul>
          <li>You are the assignee for the bug.</li>
      </ul>
    </body>
</html>