Bug 76405

Summary:

Hit ASSERTION FAILED: table()->collapseBorders() on techcrunch.com

Product:

WebKit

Reporter:

Simon Fraser (smfr) <simon.fraser>

Component:

Layout and Rendering

Assignee:

Robert Hogan <robert>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

abecsi, jchaffraix, jonlee, ossy, robert

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

URL:

http://techcrunch.com

Attachments:

Description	Flags
Patch	jchaffraix: review+

Simon Fraser (smfr)

Reported 2012-01-16 15:37:01 PST

ASSERTION FAILED: table()->collapseBorders() /Volumes/SSData/Development/OSX/webkit/OpenSource/Source/WebCore/rendering/RenderTableSection.cpp(1363) : void WebCore::RenderTableSection::setCachedCollapsedBorder(const WebCore::RenderTableCell *, WebCore::CollapsedBorderSide, WebCore::CollapsedBorderValue) 1 0x104e05461 WebCore::RenderTableSection::setCachedCollapsedBorder(WebCore::RenderTableCell const*, WebCore::CollapsedBorderSide, WebCore::CollapsedBorderValue) 2 0x104df6837 WebCore::RenderTableCell::collapsedStartBorder(WebCore::IncludeBorderColorOrNot) const 3 0x104df9a54 WebCore::RenderTableCell::collectBorderValues(WTF::Vector<WebCore::CollapsedBorderValue, 0ul>&) const 4 0x104dee03f WebCore::RenderTable::recalcCollapsedBorders() 5 0x104dee75b WebCore::RenderTable::paintObject(WebCore::PaintInfo&, WebCore::IntPoint const&) 6 0x104dee48d WebCore::RenderTable::paint(WebCore::PaintInfo&, WebCore::IntPoint const&) 7 0x104c1e3bf WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::IntPoint const&) 8 0x104c1e006 WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::IntPoint const&) 9 0x104c1ea05 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::IntPoint const&) 10 0x104c1c81d WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::IntPoint const&) 11 0x104c1e3bf WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::IntPoint const&) 12 0x104c1e006 WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::IntPoint const&) 13 0x104c1ea05 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::IntPoint const&) 14 0x104c1c81d WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::IntPoint const&) 15 0x104c1e3bf WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::IntPoint const&) 16 0x104c1e006 WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::IntPoint const&) 17 0x104c1ea05 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::IntPoint const&) 18 0x104c1c81d WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::IntPoint const&) 19 0x104c1e3bf WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::IntPoint const&) 20 0x104c1e006 WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::IntPoint const&) 21 0x104c1ea05 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::IntPoint const&) 22 0x104c1c81d WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::IntPoint const&) 23 0x104cff2ae WebCore::RenderLayer::paintLayerContents(WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::RenderObject*, WebCore::RenderRegion*, WTF::HashMap<WebCore::OverlapTestRequestClient*, WebCore::IntRect, WTF::PtrHash<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::IntRect> >*, unsigned int) 24 0x104cfe9c6 WebCore::RenderLayer::paintLayerContentsAndReflection(WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::RenderObject*, WebCore::RenderRegion*, WTF::HashMap<WebCore::OverlapTestRequestClient*, WebCore::IntRect, WTF::PtrHash<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::IntRect> >*, unsigned int) 25 0x104cfe0f5 WebCore::RenderLayer::paintLayer(WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::RenderObject*, WebCore::RenderRegion*, WTF::HashMap<WebCore::OverlapTestRequestClient*, WebCore::IntRect, WTF::PtrHash<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::IntRect> >*, unsigned int) 26 0x104d0034f WebCore::RenderLayer::paintList(WTF::Vector<WebCore::RenderLayer*, 0ul>*, WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::RenderObject*, WebCore::RenderRegion*, WTF::HashMap<WebCore::OverlapTestRequestClient*, WebCore::IntRect, WTF::PtrHash<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::IntRect> >*, unsigned int) 27 0x104cff591 WebCore::RenderLayer::paintLayerContents(WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::RenderObject*, WebCore::RenderRegion*, WTF::HashMap<WebCore::OverlapTestRequestClient*, WebCore::IntRect, WTF::PtrHash<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::IntRect> >*, unsigned int) 28 0x104cfe9c6 WebCore::RenderLayer::paintLayerContentsAndReflection(WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::RenderObject*, WebCore::RenderRegion*, WTF::HashMap<WebCore::OverlapTestRequestClient*, WebCore::IntRect, WTF::PtrHash<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::IntRect> >*, unsigned int) 29 0x104cfe0f5 WebCore::RenderLayer::paintLayer(WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::RenderObject*, WebCore::RenderRegion*, WTF::HashMap<WebCore::OverlapTestRequestClient*, WebCore::IntRect, WTF::PtrHash<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::IntRect> >*, unsigned int) 30 0x104cfda4c WebCore::RenderLayer::paint(WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::RenderObject*, WebCore::RenderRegion*, unsigned int) 31 0x1041df339 WebCore::FrameView::paintContents(WebCore::GraphicsContext*, WebCore::IntRect const&)

Attachments
Patch (6.50 KB, patch) 2012-01-18 13:32 PST, Robert Hogan	jchaffraix: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Andras Becsi

Comment 1 2012-01-17 10:45:56 PST

The assertion is also reached when loading the following sites: http://www.aftenposten.no/nyheter/uriks/usavalg/Ber-velgerne-stemme-pa-kandidat-som-trakk-seg-6743588.html#.TxW3rr41i2M http://www.guardian.co.uk/books/booksblog/2012/jan/17/stephen-king-face-cover This is reproducible with the Qt MiniBrowser and only happens when fixed layout is used (touch mode).

Robert Hogan

Comment 2 2012-01-17 12:14:43 PST

The ASSERT has exposed a situation where collapsed borders are being calculated for a cell that is not in a table with collapsed borders! The problem seems to be with: void RenderTable::recalcCollapsedBorders() { if (m_collapsedBordersValid) return; m_collapsedBordersValid = true; m_collapsedBorders.clear(); RenderObject* stop = nextInPreOrderAfterChildren(); for (RenderObject* o = firstChild(); o && o != stop; o = o->nextInPreOrder()) { if (o->isTableCell()) toRenderTableCell(o)->collectBorderValues(m_collapsedBorders); } RenderTableCell::sortBorderValues(m_collapsedBorders); } It is collecting border values for cells that are not in the RenderTable - I suspect a nested table.

Julien Chaffraix

Comment 3 2012-01-18 04:35:34 PST

(In reply to comment #2) > The ASSERT has exposed a situation where collapsed borders are being calculated for a cell that is not in a table with collapsed borders! The problem seems to be with: > > void RenderTable::recalcCollapsedBorders() > { > if (m_collapsedBordersValid) > return; > m_collapsedBordersValid = true; > m_collapsedBorders.clear(); > RenderObject* stop = nextInPreOrderAfterChildren(); > for (RenderObject* o = firstChild(); o && o != stop; o = o->nextInPreOrder()) { > if (o->isTableCell()) > toRenderTableCell(o)->collectBorderValues(m_collapsedBorders); > } > RenderTableCell::sortBorderValues(m_collapsedBorders); > } Just a side note, this code is really not optimized as it does not use the table's render tree structure (RenderTableSection -> RenderTableRow -> RenderTableCell). The side effect that you pointed out is that it will happily recurse into a nested table. I suggested on IRC to fix this loop either by detecting and skipping nested tables or by not recursing into cells. Actually making it use the rendering structure would achieve the same result and clean up the code so that would be my choice.

Jon Lee

Comment 4 2012-01-18 12:02:22 PST

gmail.com also.

Robert Hogan

Comment 5 2012-01-18 13:32:50 PST

Created attachment 122982 [details] Patch

Julien Chaffraix

Comment 6 2012-01-18 15:35:47 PST

Comment on attachment 122982 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=122982&action=review > Source/WebCore/rendering/RenderTable.cpp:451 > + for (RenderObject* o = firstChild(); o; o = o->nextSibling()) { > + if (!o->isTableSection()) |section| would be a better name for |o|. > Source/WebCore/rendering/RenderTable.cpp:459 > + toRenderTableCell(cell)->collectBorderValues(m_collapsedBorders); Would be nice to add an ASSERT here that cell->table() == this (we never want to collect borders from any other table).

Robert Hogan

Comment 7 2012-01-19 12:27:43 PST

Committed r105433: <http://trac.webkit.org/changeset/105433>

Csaba Osztrogonác

Comment 8 2012-01-19 12:53:31 PST

Comment on attachment 122982 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=122982&action=review Could you fix the broken builds? >> Source/WebCore/rendering/RenderTable.cpp:459 >> + toRenderTableCell(cell)->collectBorderValues(m_collapsedBorders); > > Would be nice to add an ASSERT here that cell->table() == this (we never want to collect borders from any other table). This assert broke debug builds: ../../../../Source/WebCore/rendering/RenderTable.cpp: In member function ‘void WebCore::RenderTable::recalcCollapsedBorders()’: ../../../../Source/WebCore/rendering/RenderTable.cpp:459: error: ‘class WebCore::RenderObject’ has no member named ‘table’

Csaba Osztrogonác

Comment 9 2012-01-19 13:01:56 PST

Reopen, because it broke debug builds.

Csaba Osztrogonác

Comment 10 2012-01-19 13:14:05 PST

Fixed by http://trac.webkit.org/changeset/105438

Note You need to log in before you can comment on or make changes to this bug.