135558 2014-08-04 01:29:41 -0700 ASSERTION FAILED: !needsLayout() in WebCore::RenderTableSection::layoutRows 2016-08-03 14:40:26 -0700 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) Unspecified Unspecified RESOLVED WORKSFORME P2 Normal --- 116980 1 rhodovan.u-szeged webkit-unassigned bfulgham hyatt oldest_to_newest 1026611 0 235968 rhodovan.u-szeged 2014-08-04 01:29:41 -0700 Created attachment 235968 Test case The following test causes the assertion failure: <style> * { display:table-cell; -webkit-column-count:3; } </style> Backtrace: ASSERTION FAILED: !needsLayout() ../../Source/WebCore/rendering/RenderTableSection.cpp(669) : void WebCore::RenderTableSection::layoutRows() ... Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fff97334700 (LWP 28215)] 0x00007ffff30191c8 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329 329 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff30191c8 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329 #1 0x00007ffff3efcbb4 in WebCore::RenderTableSection::layoutRows (this=0x8075d0) at ../../Source/WebCore/rendering/RenderTableSection.cpp:669 #2 0x00007ffff3ee654e in WebCore::RenderTable::layout (this=0x8072d0) at ../../Source/WebCore/rendering/RenderTable.cpp:525 #3 0x00007ffff3d7b918 in WebCore::RenderBlockFlow::layoutBlockChild (this=0x91d860, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:713 #4 0x00007ffff3d7b45a in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x91d860, relayoutChildren=false, maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:632 #5 0x00007ffff3d7a958 in WebCore::RenderBlockFlow::layoutBlock (this=0x91d860, relayoutChildren=false, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:485 #6 0x00007ffff3d50987 in WebCore::RenderBlock::layout (this=0x91d860) at ../../Source/WebCore/rendering/RenderBlock.cpp:1018 #7 0x00007ffff3e06af7 in WebCore::RenderFlowThread::layout (this=0x91d860) at ../../Source/WebCore/rendering/RenderFlowThread.cpp:201 #8 0x00007ffff3ea57be in WebCore::RenderMultiColumnFlowThread::layout (this=0x91d860) at ../../Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp:135 #9 0x00007ffff3d8908a in WebCore::RenderBlockFlow::layoutSpecialExcludedChild (this=0x7da2c0, relayoutChildren=true) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:3629 #10 0x00007ffff3d7b338 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x7da2c0, relayoutChildren=true, maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:604 #11 0x00007ffff3d7a958 in WebCore::RenderBlockFlow::layoutBlock (this=0x7da2c0, relayoutChildren=true, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:485 #12 0x00007ffff3d50987 in WebCore::RenderBlock::layout (this=0x7da2c0) at ../../Source/WebCore/rendering/RenderBlock.cpp:1018 #13 0x00007ffff3d7b918 in WebCore::RenderBlockFlow::layoutBlockChild (this=0x820690, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:713 #14 0x00007ffff3d7b45a in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x820690, relayoutChildren=true, maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:632 #15 0x00007ffff3d7a958 in WebCore::RenderBlockFlow::layoutBlock (this=0x820690, relayoutChildren=true, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:485 #16 0x00007ffff3d50987 in WebCore::RenderBlock::layout (this=0x820690) at ../../Source/WebCore/rendering/RenderBlock.cpp:1018 #17 0x00007ffff3f28aad in WebCore::RenderView::layoutContent (this=0x820690, state=...) at ../../Source/WebCore/rendering/RenderView.cpp:232 #18 0x00007ffff3f29166 in WebCore::RenderView::layout (this=0x820690) at ../../Source/WebCore/rendering/RenderView.cpp:357 #19 0x00007ffff3acf1f4 in WebCore::FrameView::layout (this=0xa097b0, allowSubtree=true) at ../../Source/WebCore/page/FrameView.cpp:1282 #20 0x00007ffff353f72f in WebCore::Document::implicitClose (this=0x8b90b0) at ../../Source/WebCore/dom/Document.cpp:2438 #21 0x00007ffff399e745 in WebCore::FrameLoader::checkCallImplicitClose (this=0x9fc4e8) at ../../Source/WebCore/loader/FrameLoader.cpp:898 #22 0x00007ffff399e4f0 in WebCore::FrameLoader::checkCompleted (this=0x9fc4e8) at ../../Source/WebCore/loader/FrameLoader.cpp:844 ---Type <return> to continue, or q <return> to quit--- #23 0x00007ffff399e278 in WebCore::FrameLoader::finishedParsing (this=0x9fc4e8) at ../../Source/WebCore/loader/FrameLoader.cpp:764 #24 0x00007ffff35470db in WebCore::Document::finishedParsing (this=0x8b90b0) at ../../Source/WebCore/dom/Document.cpp:4519 #25 0x00007ffff383a805 in WebCore::HTMLConstructionSite::finishedParsing (this=0xa0a098) at ../../Source/WebCore/html/parser/HTMLConstructionSite.cpp:395 #26 0x00007ffff3874c57 in WebCore::HTMLTreeBuilder::finished (this=0xa0a080) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2997 #27 0x00007ffff38423a0 in WebCore::HTMLDocumentParser::end (this=0x915730) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:451 #28 0x00007ffff384248b in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd (this=0x915730) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:462 #29 0x00007ffff3840ff9 in WebCore::HTMLDocumentParser::prepareToStopParsing (this=0x915730) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:165 #30 0x00007ffff38424ce in WebCore::HTMLDocumentParser::attemptToEnd (this=0x915730) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:474 #31 0x00007ffff3842585 in WebCore::HTMLDocumentParser::finish (this=0x915730) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:502 #32 0x00007ffff3991445 in WebCore::DocumentWriter::end (this=0x850a80) at ../../Source/WebCore/loader/DocumentWriter.cpp:250 #33 0x00007ffff397e49b in WebCore::DocumentLoader::finishedLoading (this=0x8509e0, finishTime=0) at ../../Source/WebCore/loader/DocumentLoader.cpp:441 #34 0x00007ffff397e204 in WebCore::DocumentLoader::notifyFinished (this=0x8509e0, resource=0x88b970) at ../../Source/WebCore/loader/DocumentLoader.cpp:375 #35 0x00007ffff3a24a99 in WebCore::CachedResource::checkNotify (this=0x88b970) at ../../Source/WebCore/loader/cache/CachedResource.cpp:334 #36 0x00007ffff3a24b80 in WebCore::CachedResource::finishLoading (this=0x88b970) at ../../Source/WebCore/loader/cache/CachedResource.cpp:350 #37 0x00007ffff3a21b3a in WebCore::CachedRawResource::finishLoading (this=0x88b970, data=0x9e7c00) at ../../Source/WebCore/loader/cache/CachedRawResource.cpp:98 #38 0x00007ffff39d87da in WebCore::SubresourceLoader::didFinishLoading (this=0x914710, finishTime=0) at ../../Source/WebCore/loader/SubresourceLoader.cpp:310 #39 0x00007ffff39d4cc7 in WebCore::ResourceLoader::didFinishLoading (this=0x914710, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:517 #40 0x00007ffff4297429 in WebCore::readCallback (asyncResult=0x9e81d0, data=0x914ec0) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1302 #41 0x00007fffec1d82ea in async_ready_callback_wrapper (source_object=0x98cb30, res=0x9e81d0, user_data=0x914ec0) at ginputstream.c:519 #42 0x00007fffec1f7ceb in g_task_return_now (task=0x9e81d0) at gtask.c:1108 #43 0x00007fffec1f7d09 in complete_in_idle_cb (task=0x9e81d0) at gtask.c:1117 #44 0x00007fffeb44e2e6 in g_main_dispatch (context=0x677bc0) at gmain.c:3065 #45 g_main_context_dispatch (context=context@entry=0x677bc0) at gmain.c:3641 #46 0x00007fffeb44e638 in g_main_context_iterate (context=0x677bc0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3712 ---Type <return> to continue, or q <return> to quit--- #47 0x00007fffeb44ea3a in g_main_loop_run (loop=0x6f0010) at gmain.c:3906 #48 0x00007ffff306a156 in WTF::RunLoop::run () at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:59 #49 0x00007ffff2fa35e0 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffd948) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61 #50 0x00007ffff2fa3445 in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffd948) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:73 #51 0x000000000040085d in main (argc=2, argv=0x7fffffffd948) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:32 1139920 1 264926 rhodovan.u-szeged 2015-11-06 02:36:09 -0800 Created attachment 264926 Test Replacing the original test case since it doesn't reproduce the issue anymore. 1217211 2 bfulgham 2016-08-03 14:40:26 -0700 This issue no longer occurs under GuardMalloc or ASAN as of r204037. If you believe there is still a bug, please reopen this issue with a revised test case. 235968 2014-08-04 01:29:41 -0700 2015-11-06 02:36:09 -0800 Test case crash.html text/html 72 rhodovan.u-szeged PHN0eWxlPiAKKiB7CiAgZGlzcGxheTp0YWJsZS1jZWxsOwogIC13ZWJraXQtY29sdW1uLWNvdW50 OjM7Cn0KPC9zdHlsZT4K 264926 2015-11-06 02:36:09 -0800 2015-11-06 02:36:09 -0800 Test test.html text/html 124 rhodovan.u-szeged PCFET0NUWVBFIGh0bWw+CjxzdHlsZT4KKiB7CiAgICBtYXgtaGVpZ2h0OiAwdnc7CiAgICBvdmVy Zmxvdy15OiAtd2Via2l0LXBhZ2VkLXg7Cn0KPC9zdHlsZT4KPHRhYmxlPgogICAgPHRkPmE8L3Rk Pgo8L3RhYmxlPg==