ASSERTION FAILED: containingBlock->isLayoutInline() && containingBlock->isInFlow |
||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5298563369664512 Fuzzer: mbarbella_js_mutation_layout Job Type: linux_debug_content_shell_drt Platform Id: linux Crash Type: ASSERT Crash Address: Crash State: ASSERTION FAILED: containingBlock->isLayoutInline() && containingBlock->isInFlow blink::LayoutBox::containingBlockLogicalWidthForPositioned blink::LayoutBox::computePositionedLogicalWidth Minimized Testcase (0.30 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv969Fb7DzdtYHoXiXHT_8Uk67V8yrUQ7OdOm0RQ0u7fg4sNxFVMkSgFGq_aUM1KUAYEqJWmK8-_BdqkZ5FvH1yEnv6l9iTH61OAc37xON6mmWYNQ7AmVXERUMjuDsgVT40nMRf-RKMIahKvFEETb0b8uWyK7pg <style> .class1 { position: relative; } .class2 { position: absolute;</style> <script> window.onload = function() { document.designMode="on"; document.execCommand("SelectAll"); document.execCommand("Strikethrough"); } </script> <i class="class1"> <div> <xmp class="class2"> A Filer: brajkumar See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
May 4 2016
eae@ for layout-dev triage.
,
May 4 2016
,
Jul 4 2016
,
Sep 23 2016
ClusterFuzz has detected this issue as fixed in range 420372:420465. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5298563369664512 Fuzzer: mbarbella_js_mutation_layout Job Type: linux_debug_content_shell_drt Platform Id: linux Crash Type: ASSERT Crash Address: Crash State: containingBlock->isLayoutInline() && containingBlock->isInFlowPositioned() blink::LayoutBox::containingBlockLogicalWidthForPositioned blink::LayoutBox::computePositionedLogicalWidth Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=358612:358651 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=420372:420465 Minimized Testcase (0.30 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv94O0ybkNlzzEU4k1pGxWJQ7CJrrbhlholix2GTMwmEqEK0-TGQ8vB_cJjRvLMcWrwk3GXhgw00p7gXXyL6wNFy_FJpKmdYuIIKDboiIoUDntGqdDAURlpvDAHtmOzFrCBXit2dm5TVKkK1aygoO9_LLtgr2iQ?testcase_id=5298563369664512 <style> .class1 { position: relative; } .class2 { position: absolute;</style> <script> window.onload = function() { document.designMode="on"; document.execCommand("SelectAll"); document.execCommand("Strikethrough"); } </script> <i class="class1"> <div> <xmp class="class2"> A See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Sep 23 2016
ClusterFuzz testcase is verified as fixed, closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by brajkumar@chromium.org
, May 4 2016Labels: findit-for-crash Te-Logged
Owner: dsinclair@chromium.org
Status: Assigned (was: Available)