failed DCHECK !NeedsStyleRecalc |
||||
Issue descriptionChrome Version : ToT r#504882 OS Version: Android URLs (if applicable) : https://hypocampus.applications.uwa.edu.au/travelmanager.html Above URL hits the DCHECK in a debug build on load: signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr -------- [FATAL:LayoutTable.h(612)] Check failed: !NeedsSectionRecalc(). Stack Trace: RELADDR FUNCTION FILE:LINE 000c4bf5 base::debug::StackTrace::StackTrace()+20 /home/bokan/chrome/src/base/debug/stack_trace.cc:199 000f7d0d logging::LogMessage::~LogMessage()+212 /home/bokan/chrome/src/base/logging.cc:560 0109e6c1 blink::LayoutTable::TopSection() const+116 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutTable.h:612 010a0735 blink::LayoutTable::TopNonEmptySection() const+16 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutTable.cpp:1047 0109fce5 blink::LayoutTable::UpdateCollapsedOuterBorders() const+104 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutTable.cpp:1679 ----------------------------------------------------- r0 00000000 r1 00007c49 r2 00000006 r3 00000008 r4 a7e38978 r5 00000006 r6 a7e38920 r7 0000010c r8 a7e31c70 r9 00000000 sl 88f1f177 fp a7e31bf8 ip 0000000e sp a7e2d5a0 lr a99f45c7 pc a99f6e30 Stack Trace: FUNCTION FILE:LINE tgkill+12 /system/lib/libc.so pthread_kill+34 /system/lib/libc.so raise+10 /system/lib/libc.so __libc_android_abort+34 /system/lib/libc.so abort+4 /system/lib/libc.so base::debug::(anonymous namespace)::DebugBreak()+12 /home/bokan/chrome/src/base/debug/debugger_posix.cc:228 base::debug::BreakDebugger()+10 /home/bokan/chrome/src/base/debug/debugger_posix.cc:258 logging::LogMessage::~LogMessage()+1970 /home/bokan/chrome/src/base/logging.cc:791 blink::LayoutTable::TopSection() const+116 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutTable.h:612 blink::LayoutTable::TopNonEmptySection() const+14 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutTable.cpp:1047 blink::LayoutTable::UpdateCollapsedOuterBorders() const+104 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutTable.cpp:1679 blink::LayoutTable::BorderLeft() const+28 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutTable.cpp:1255 blink::PhysicalToLogicalGetter<blink::LayoutUnit, blink::LayoutBoxModelObject>::Start() const+82 /home/bokan/chrome/src/third_party/WebKit/Source/platform/text/WritingModeUtils.h:226 blink::LayoutBoxModelObject::BorderStart() const+30 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.h:261 blink::LayoutBoxModelObject::BorderAndPaddingLogicalWidth() const+14 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.h:317 blink::LayoutFlexibleBox::ComputeMainAxisExtentForChild(blink::LayoutBox const&, blink::SizeType, blink::Length const&) const+122 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp:571 blink::LayoutFlexibleBox::ComputeMinAndMaxSizesForChild(blink::LayoutBox const&) const+586 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp:1066 blink::LayoutFlexibleBox::ConstructFlexItem(blink::LayoutBox&, blink::LayoutFlexibleBox::ChildLayoutType)+112 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp:1194 blink::LayoutFlexibleBox::LayoutFlexItems(bool, blink::SubtreeLayoutScope&)+130 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp:864 blink::LayoutFlexibleBox::UpdateBlockLayout(bool)+424 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp:361 blink::LayoutBlock::UpdateLayout()+228 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutBlock.cpp:427 blink::LayoutObject::ForceChildLayout()+30 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutObject.cpp:2948 blink::LayoutFlexibleBox::ConstructFlexItem(blink::LayoutBox&, blink::LayoutFlexibleBox::ChildLayoutType)+88 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp:1189 blink::LayoutFlexibleBox::LayoutFlexItems(bool, blink::SubtreeLayoutScope&)+130 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp:864 blink::LayoutFlexibleBox::UpdateBlockLayout(bool)+424 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp:361 blink::LayoutBlock::UpdateLayout()+228 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutBlock.cpp:427 blink::LayoutObject::ForceChildLayout()+30 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutObject.cpp:2948 blink::LayoutFlexibleBox::ConstructFlexItem(blink::LayoutBox&, blink::LayoutFlexibleBox::ChildLayoutType)+88 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp:1189 blink::LayoutFlexibleBox::LayoutFlexItems(bool, blink::SubtreeLayoutScope&)+130 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp:864 blink::LayoutFlexibleBox::UpdateBlockLayout(bool)+424 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp:361 blink::LayoutBlock::UpdateLayout()+228 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutBlock.cpp:427 blink::LayoutBlockFlow::PositionAndLayoutOnceIfNeeded(blink::LayoutBox&, blink::LayoutUnit, blink::BlockChildrenLayoutInfo&)+378 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:759 blink::LayoutBlockFlow::LayoutBlockChild(blink::LayoutBox&, blink::BlockChildrenLayoutInfo&)+168 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:822 blink::LayoutBlockFlow::LayoutBlockChildren(bool, blink::SubtreeLayoutScope&, blink::LayoutUnit, blink::LayoutUnit)+624 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:1527 blink::LayoutBlockFlow::LayoutChildren(bool, blink::SubtreeLayoutScope&)+186 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:567 blink::LayoutBlockFlow::UpdateBlockLayout(bool)+456 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:438 blink::LayoutBlock::UpdateLayout()+228 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutBlock.cpp:427 blink::LayoutBlockFlow::PositionAndLayoutOnceIfNeeded(blink::LayoutBox&, blink::LayoutUnit, blink::BlockChildrenLayoutInfo&)+378 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:759 blink::LayoutBlockFlow::LayoutBlockChild(blink::LayoutBox&, blink::BlockChildrenLayoutInfo&)+168 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:822 blink::LayoutBlockFlow::LayoutBlockChildren(bool, blink::SubtreeLayoutScope&, blink::LayoutUnit, blink::LayoutUnit)+624 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:1527 blink::LayoutBlockFlow::LayoutChildren(bool, blink::SubtreeLayoutScope&)+186 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:567 blink::LayoutBlockFlow::UpdateBlockLayout(bool)+456 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:438 blink::LayoutBlock::UpdateLayout()+228 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutBlock.cpp:427 blink::LayoutView::LayoutContent()+122 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutView.cpp:225 blink::LayoutView::UpdateLayout()+1126 /home/bokan/chrome/src/third_party/WebKit/Source/core/layout/LayoutView.cpp:317 blink::LocalFrameView::PerformLayout(bool)+896 /home/bokan/chrome/src/third_party/WebKit/Source/core/frame/LocalFrameView.cpp:1090 blink::LocalFrameView::UpdateLayout()+2432 /home/bokan/chrome/src/third_party/WebKit/Source/core/frame/LocalFrameView.cpp:1276 blink::Document::UpdateStyleAndLayout()+294 /home/bokan/chrome/src/third_party/WebKit/Source/core/dom/Document.cpp:2371 blink::Document::UpdateStyleAndLayoutIgnorePendingStylesheets(blink::Document::RunPostLayoutTasks)+26 /home/bokan/chrome/src/third_party/WebKit/Source/core/dom/Document.cpp:2461 blink::Document::UpdateStyleAndLayoutIgnorePendingStylesheetsForNode(blink::Node*)+144 /home/bokan/chrome/src/third_party/WebKit/Source/core/dom/Document.cpp:2347 blink::Element::scrollHeight()+38 /home/bokan/chrome/src/third_party/WebKit/Source/core/dom/Element.cpp:971 blink::ElementV8Internal::scrollHeightAttributeGetter(v8::FunctionCallbackInfo<v8::Value> const&)+54 /home/bokan/chrome/src/out/ClankDebug/gen/blink/bindings/core/v8/V8Element.cpp:463 blink::V8Element::scrollHeightAttributeGetterCallback(v8::FunctionCallbackInfo<v8::Value> const&)+16 /home/bokan/chrome/src/out/ClankDebug/gen/blink/bindings/core/v8/V8Element.cpp:2274 v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo<v8::Value> const&))+294 /home/bokan/chrome/src/v8/src/api-arguments.cc:25 v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, v8::internal::BuiltinArguments)+724 /home/bokan/chrome/src/v8/src/builtins/builtins-api.cc:112 v8::internal::Builtins::InvokeApiFunction(v8::internal::Isolate*, bool, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*, v8::internal::Handle<v8::internal::HeapObject>)+648 /home/bokan/chrome/src/v8/src/builtins/builtins-api.cc:219 v8::internal::Object::GetPropertyWithAccessor(v8::internal::LookupIterator*)+1268 /home/bokan/chrome/src/v8/src/objects.cc:1569 v8::internal::LoadIC::Load(v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Name>)+612 /home/bokan/chrome/src/v8/src/ic/ic.cc:459 v8::internal::__RT_impl_Runtime_LoadIC_Miss(v8::internal::Arguments, v8::internal::Isolate*)+172 /home/bokan/chrome/src/v8/src/ic/ic.cc:2056 <unknown> <anonymous:7fb06000>
,
Oct 2 2017
,
Oct 2 2017
related to issue 746570
,
Oct 3 2017
Xianzhu, you were right, we should probably just always allow the previous layout's collapsed borders to be used instead of special casing scroll anchoring. Though I might try to construct a case based off this repro that shows a mislayout because the used values are old.
,
Oct 4 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/41ad015abed2dbe9e0fbe64fecfc73c94afda343 commit 41ad015abed2dbe9e0fbe64fecfc73c94afda343 Author: David Grogan <dgrogan@chromium.org> Date: Wed Oct 04 01:35:48 2017 [css-tables] Remove DCHECK around dirty borders If something wants a table's collapsed borders when they might have changed but before we've recalculated them, just return the old ones. There used to be an explicit exception allowing this for scroll anchoring, but other things need the borders too. The scroll anchoring specific code is removed in this patch. Bug: 746570 , 770348 Change-Id: I1b7ceb607cf27ff04eb941ee9aabdadb2e5bfe2e Reviewed-on: https://chromium-review.googlesource.com/699735 Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org> Commit-Queue: David Grogan <dgrogan@chromium.org> Cr-Commit-Position: refs/heads/master@{#506269} [add] https://crrev.com/41ad015abed2dbe9e0fbe64fecfc73c94afda343/third_party/WebKit/LayoutTests/fast/table/flexbox-collapsed-borders-crash.html [modify] https://crrev.com/41ad015abed2dbe9e0fbe64fecfc73c94afda343/third_party/WebKit/Source/core/layout/LayoutTable.cpp [modify] https://crrev.com/41ad015abed2dbe9e0fbe64fecfc73c94afda343/third_party/WebKit/Source/core/layout/LayoutTable.h [modify] https://crrev.com/41ad015abed2dbe9e0fbe64fecfc73c94afda343/third_party/WebKit/Source/core/layout/ScrollAnchor.cpp
,
Oct 4 2017
|
||||
►
Sign in to add a comment |
||||
Comment 1 by e...@chromium.org
, Sep 30 2017Components: -Blink>Layout Blink>Layout>Table
Status: Available (was: Untriaged)