116217 2013-05-16 04:18:19 -0700 [CSS Regions] Assertion when cleaning-up RenderBoxRegionInfo objects after using negative margin-top to push the box into a previous region 2022-07-12 17:17:23 -0700 1 1 1 Unclassified WebKit CSS 528+ (Nightly build) Unspecified Unspecified RESOLVED WONTFIX AdobeTracked P2 Normal --- 57312 1 stavila webkit-unassigned bfulgham WebkitBugTracker oldest_to_newest 889760 0 201941 stavila 2013-05-16 04:18:19 -0700 Created attachment 201941 File that reproduces the problem When content is flowed into multiple regions, taking a box which would normally flow in the 3rd region and using a negative margin-top on it to push it back to the first would cause an assertion when cleaning-up (and a memory leak on release build). The problem seems to be that a RenderBoxRegionInfo object is generated for this box in the first region but, when calling RenderFlowThread::removeRenderBoxRegionInfo (RenderBox* box), it only destroys RenderBoxRegionInfo objects for the regions returned by the RenderFlowThread::getRegionRangeForBox method, which only returns regions 2 and 3, not taking into account that the negative margin-top pushed the box into a different region. Attached test that reproduces the problem. Remove the following line to see what the page looks like without it crashing: document.getElementById("divMain").style.display = "none"; 900212 1 michelangelo 2013-06-13 10:56:39 -0700 Still repros on today's nightly (r151543) 1882808 2 bfulgham 2022-07-12 17:17:23 -0700 CSS Regions were removed in Bug 174978. 201941 2013-05-16 04:18:19 -0700 2013-05-16 04:18:19 -0700 File that reproduces the problem offsetLeft-offsetTop-in-region.html text/html 2337 stavila PGh0bWw+CjxoZWFkPgoJPHN0eWxlIHR5cGU9InRleHQvY3NzIj4KCQkuZGl2VGV4dCB7CgkJCWJv cmRlcjogMXB4IHNvbGlkIGdyZWVuOwoJCQljb2xvcjogZ3JlZW47CgkJCWZvbnQtc2l6ZTogMTRw eDsKCQl9CgoJCSNkaXZUZXh0MSB7CgkJCWJvcmRlci1jb2xvcjogIzAwOTk5OTsKCQkJY29sb3I6 ICMwMDk5OTk7CgkJCW1hcmdpbjogMTBweDsKCQkJd2lkdGg6IDkwJTsKCQkJaGVpZ2h0OiAyODBw eDsKCQl9CgoJCSNkaXZUZXh0MiB7CgkJCXdpZHRoOiAyMDNweDsKCQkJaGVpZ2h0OiAyNjVweDsK CQkJcG9zaXRpb246IHN0YXRpYzsKCQkJdG9wOiAxMHB4OwoJCX0KCgkJI2RpdlRleHQzIHsKCQkJ bWFyZ2luOiA0cHg7CgkJCW1hcmdpbi10b3A6IC00MDBweDsKCQkJd2lkdGg6IDE1MCU7CgkJCWhl aWdodDogMjA1cHg7CgkJCXBvc2l0aW9uOiByZWxhdGl2ZTsKCQkJbGVmdDogMjBweDsKCQkJdG9w OiAxMjBweDsKCQkJY29sb3I6ICM3Nzc3MDA7CgkJCWJvcmRlci1jb2xvcjogIzc3NzcwMDsKCQl9 CgoJCSNkaXZNYWluIHsKCQkJYm9yZGVyOiAycHggc29saWQgYmx1ZTsKCQkJd2lkdGg6IDc1JTsK CQkJaGVpZ2h0OiA2MTBweDsKCQkJcGFkZGluZy1sZWZ0OiA1cHg7CgkJCW1hcmdpbjogNXB4OwoJ CQltYXJnaW4tbGVmdDogMjAlOwoJCQlsZWZ0OiA0MHB4OwoJCQktd2Via2l0LWZsb3ctaW50bzog ZmxvdzsKCQl9CgoJCSNkdW1teTEgewoJCQl3aWR0aDogMTAwcHg7CgkJCWhlaWdodDogMjVweDsK CQkJYm9yZGVyOiAxcHggc29saWQgYmxhY2s7CgkJCW1hcmdpbjogNXB4OwoJCQltYXJnaW4tbGVm dDogMjBweDsKCQl9CgoJCS5yZWdpb24gewoJCQktd2Via2l0LWZsb3ctZnJvbTogZmxvdzsKCQkJ Ym9yZGVyOiAxcHggc29saWQgcmVkOwoJCQltYXJnaW46IDIwcHg7CgkJfQoKCQkjZmlyc3RfcmVn aW9uIHsKCQkJd2lkdGg6IDUwMHB4OwoJCQloZWlnaHQ6IDMwMHB4OwoJCX0KCgkJI3NlY29uZF9y ZWdpb24gewoJCQl3aWR0aDogMzMwcHg7CgkJCWhlaWdodDogMTUwcHg7CgkJfQoKCQkjdGhpcmRf cmVnaW9uIHsKCQkJd2lkdGg6IDMyMHB4OwoJCQloZWlnaHQ6IDE4MHB4OwoJCX0KCTwvc3R5bGU+ CgoJPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPgoJCWZ1bmN0aW9uIG15T25Mb2FkKCkg ewoJCQkvLyBUSEVTRSBUV08gQ0FMTFMgVFJJR0dFUiBUSEUgUFJPQkxFTSwgCgkJCS8vIFJFTU9W RSBUSEUgU0VDT05EIENBTEwgVE8gU0VFIFRIRSBQQUdFIFdJVEhPVVQgSVQgQ1JBU0hJTkcKCQkJ ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImRpdlRleHQzIikub2Zmc2V0UGFyZW50OwoJCQlkb2N1 bWVudC5nZXRFbGVtZW50QnlJZCgiZGl2TWFpbiIpLnN0eWxlLmRpc3BsYXkgPSAibm9uZSI7CgkJ fQoJPC9zY3JpcHQ+CjwvaGVhZD4KCjxib2R5IGlkPSJib2R5IiBvbmxvYWQgPSAibXlPbkxvYWQo KTsiPgoJPGRpdiBpZD0iZGl2TWFpbiI+CgkJPGRpdiBjbGFzcz0iZHVtbXkiIGlkPSJkdW1teTEi PmR1bW15PC9kaXY+CgkJPGRpdiBjbGFzcz0iZGl2VGV4dCIgaWQ9ImRpdlRleHQxIj5UaGlzIGlz IDxiPmRpdlRleHQxPC9iPjwvZGl2PgoJCTxkaXYgY2xhc3M9ImRpdlRleHQiIGlkPSJkaXZUZXh0 MiI+VGhpcyBpcyA8Yj5kaXZUZXh0MjwvYj4KCQkJPGRpdiBjbGFzcz0iZGl2VGV4dCIgaWQ9ImRp dlRleHQzIj5UaGlzIGlzIDxiPmRpdlRleHQzPC9iPiwgcmVzcG9uc2libGUgZm9yIHRoZSBjcmFz aC4gSXQncyBwb3NpdGlvbiBpcyBpbiB0aGUgdGhpcmQgcmVnaW9uIGJ1dCB3YXMgcHVzaGVkIHRv IHRoZSBmaXJzdCByZWdpb24gYnkgYSBuZWdhdGl2ZSBtYXJnaW4tdG9wLjxici8+VGhlIHByb2Js ZW0gc2VlbXMgdG8gYmUgdGhhdCBhIFJlbmRlckJveFJlZ2lvbkluZm8gb2JqZWN0IGlzIGdlbmVy YXRlZCBmb3IgdGhpcyBib3ggaW4gdGhlIDFzdCByZWdpb24gYnV0LCB3aGVuIGNhbGxpbmcgUmVu ZGVyRmxvd1RocmVhZDo6cmVtb3ZlUmVuZGVyQm94UmVnaW9uSW5mbyAoUmVuZGVyQm94KiBib3gp LCBpdCBvbmx5IGRlc3Ryb3lzIFJlbmRlckJveFJlZ2lvbkluZm8gb2JqZWN0cyBmb3IgdGhlIHJl Z2lvbnMgcmV0dXJuZWQgYnkgdGhlIFJlbmRlckZsb3dUaHJlYWQ6OmdldFJlZ2lvblJhbmdlRm9y Qm94IG1ldGhvZCwgd2hpY2ggb25seSByZXR1cm5zIHJlZ2lvbnMgMiBhbmQgMy48L2Rpdj4KCQk8 L2Rpdj4JCQoJPC9kaXY+CgoJPGRpdiBjbGFzcz0icmVnaW9uIiBpZD0iZmlyc3RfcmVnaW9uIj48 L2Rpdj4KCTxkaXYgY2xhc3M9InJlZ2lvbiIgaWQ9InNlY29uZF9yZWdpb24iPjwvZGl2PgoJPGRp diBjbGFzcz0icmVnaW9uIiBpZD0idGhpcmRfcmVnaW9uIj48L2Rpdj4KPC9ib2R5Pgo8L2h0bWw+