137273 2014-09-30 15:11:40 -0700 Descendant is being put into the wrong flow thread with nested columns and spans 2015-02-16 10:07:04 -0800 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=141612 InRadar P2 Normal --- 1 hyatt hyatt abucur bdakin commit-queue darin dbates ddkilzer esprehn+autocc glenn kling koivisto kondapallykalyan mihnea simon.fraser webkit-bug-importer zalan oldest_to_newest 1038370 0 hyatt 2014-09-30 15:11:40 -0700 Descendant is being put into the wrong flow thread with nested columns and spans. See the FIXME in isValidColumnSpanner in RenderMultiColumnFlowThread.cpp. 1046300 1 240986 hyatt 2014-11-04 17:20:46 -0800 Created attachment 240986 Patch 1046486 2 240986 simon.fraser 2014-11-05 09:11:58 -0800 Comment on attachment 240986 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=240986&action=review > Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp:387 > + placeholder.parent()->removeChild(placeholder); I think you want a "// FIXME: placeholder is leaked" here. 1046487 3 240986 ddkilzer 2014-11-05 09:14:19 -0800 Comment on attachment 240986 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=240986&action=review > Source/WebCore/ChangeLog:20 > + The second fix was to stop destroying the placeholder. Since the placeholder can just have been inserted, you > + can't delete it, since otherwise code further up the stack will access the deleted object. For now, we just > + leak the placeholder. Would using a RenderPtr<> for the placeholder (née descendant) fix the leak/object lifetime? >> Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp:387 >> - ancestorBlock.multiColumnFlowThread()->handleSpannerRemoval(spanner); >> - placeholder.destroy(); >> - >> + if (subtreeRoot == descendant) >> + subtreeRoot = spanner; >> + placeholder.parent()->removeChild(placeholder); > > I think you want a "// FIXME: placeholder is leaked" here. And a new bug number that tracks the leak please. 1046589 4 hyatt 2014-11-05 13:26:43 -0800 Fixed in r175641. 1046590 5 webkit-bug-importer 2014-11-05 13:27:02 -0800 <rdar://problem/18885189> 1066620 6 ddkilzer 2015-02-03 15:49:39 -0800 *** Bug 137316 has been marked as a duplicate of this bug. *** 240986 2014-11-04 17:20:46 -0800 2014-11-05 09:11:58 -0800 Patch patch.txt text/plain 4943 hyatt SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE3NTU5MikKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI0IEBACisyMDE0LTExLTA0ICBEYXZpZCBI eWF0dCAgPGh5YXR0QGFwcGxlLmNvbT4KKworICAgICAgICBEZXNjZW5kYW50IGVuZHMgdXAgaW4g d3JvbmcgZmxvdyB0aHJlYWQgd2l0aCBuZXN0ZWQgY29sdW1ucyBhbmQgc3BhbnMuCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMzcyNzMKKworICAgICAg ICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBVbnNraXBwZWQgdGhlIHR3 byBwcm9ibGVtYXRpYyBzcGFuIHRlc3RzLgorCisgICAgICAgICogcmVuZGVyaW5nL1JlbmRlck11 bHRpQ29sdW1uRmxvd1RocmVhZC5jcHA6CisgICAgICAgIChXZWJDb3JlOjppc1ZhbGlkQ29sdW1u U3Bhbm5lcik6CisgICAgICAgIFJlbW92ZSB0aGUgZ3VhcmQgYW5kIGNvbW1lbnQgYW5kIGFkZGVk IHRoZSBhc3NlcnRpb24gYmFjayBpbi4KKworICAgICAgICAoV2ViQ29yZTo6UmVuZGVyTXVsdGlD b2x1bW5GbG93VGhyZWFkOjpmbG93VGhyZWFkRGVzY2VuZGFudEluc2VydGVkKToKKyAgICAgICAg Q2hhbmdlZCB0byBubyBsb25nZXIgdXNlIGhhbmRsZVNwYW5uZXJSZW1vdmFsLiBCZWNhdXNlIHRo ZSBzcGFubmVyIHdhcyByZW1vdmVkIGZyb20gdGhlIGZsb3cgdGhyZWFkJ3MgbWFwLAorICAgICAg ICBoYW5kbGVTcGFubmVyUmVtb3ZhbCB3YXMgYSBuby1vcC4gU28gaW5zdGVhZCBJIGp1c3QgcmVt b3ZlZCB0aGUgcGxhY2Vob2xkZXIgYnkgaGFuZC4KKworICAgICAgICBUaGUgc2Vjb25kIGZpeCB3 YXMgdG8gc3RvcCBkZXN0cm95aW5nIHRoZSBwbGFjZWhvbGRlci4gU2luY2UgdGhlIHBsYWNlaG9s ZGVyIGNhbiBqdXN0IGhhdmUgYmVlbiBpbnNlcnRlZCwgeW91CisgICAgICAgIGNhbid0IGRlbGV0 ZSBpdCwgc2luY2Ugb3RoZXJ3aXNlIGNvZGUgZnVydGhlciB1cCB0aGUgc3RhY2sgd2lsbCBhY2Nl c3MgdGhlIGRlbGV0ZWQgb2JqZWN0LiBGb3Igbm93LCB3ZSBqdXN0CisgICAgICAgIGxlYWsgdGhl IHBsYWNlaG9sZGVyLgorCiAyMDE0LTExLTA0ICBKb3NlcGggUGVjb3Jhcm8gIDxwZWNvcmFyb0Bh cHBsZS5jb20+CiAKICAgICAgICAgV2ViIEluc3BlY3RvcjogUGF1c2Ugb24gZXhjZXB0aW9ucyBz aG91bGQgc2hvdyB0aGUgYWN0dWFsIGV4Y2VwdGlvbgpJbmRleDogU291cmNlL1dlYkNvcmUvcmVu ZGVyaW5nL1JlbmRlck11bHRpQ29sdW1uRmxvd1RocmVhZC5jcHAKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlck11bHRpQ29sdW1uRmxvd1RocmVhZC5jcHAJKHJl dmlzaW9uIDE3NTU1NikKKysrIFNvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJNdWx0aUNv bHVtbkZsb3dUaHJlYWQuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0yNDIsMTIgKzI0Miw4IEBAIFJl bmRlck9iamVjdCogUmVuZGVyTXVsdGlDb2x1bW5GbG93VGhyZWEKIHN0YXRpYyBib29sIGlzVmFs aWRDb2x1bW5TcGFubmVyKFJlbmRlck11bHRpQ29sdW1uRmxvd1RocmVhZCogZmxvd1RocmVhZCwg UmVuZGVyT2JqZWN0KiBkZXNjZW5kYW50KQogewogICAgIC8vIFdlIGFzc3VtZSB0aGF0IHdlJ3Jl IGluc2lkZSB0aGUgZmxvdyB0aHJlYWQuIFRoaXMgZnVuY3Rpb24gaXMgbm90IHRvIGJlIGNhbGxl ZCBvdGhlcndpc2UuCi0gICAgLy8gQVNTRVJUKGRlc2NlbmRhbnQtPmlzRGVzY2VuZGFudE9mKGZs b3dUaHJlYWQpKTsKLSAgICAvLyBGSVhNRTogUHV0IHRoaXMgYmFjayBpbiB3aGVuIHdlIGZpZ3Vy ZSBvdXQgd2h5IHNwYW5uZXItY3Jhc2guaHRtbCBpcyB0cmlnZ2VyaW5nIGl0LgotICAgIC8vIFNl ZSBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTM3MjczCi0gICAgaWYg KCFkZXNjZW5kYW50LT5pc0Rlc2NlbmRhbnRPZihmbG93VGhyZWFkKSkKLSAgICAgICAgcmV0dXJu IGZhbHNlOwotICAgIAorICAgIEFTU0VSVChkZXNjZW5kYW50LT5pc0Rlc2NlbmRhbnRPZihmbG93 VGhyZWFkKSk7CisKICAgICAvLyBGaXJzdCBtYWtlIHN1cmUgdGhhdCB0aGUgcmVuZGVyZXIgaXRz ZWxmIGhhcyB0aGUgcmlnaHQgcHJvcGVydGllcyBmb3IgYmVjb21pbmcgYSBzcGFubmVyLgogICAg IFJlbmRlclN0eWxlJiBzdHlsZSA9IGRlc2NlbmRhbnQtPnN0eWxlKCk7CiAgICAgaWYgKHN0eWxl LmNvbHVtblNwYW4oKSAhPSBDb2x1bW5TcGFuQWxsIHx8ICFpczxSZW5kZXJCb3g+KCpkZXNjZW5k YW50KSB8fCBkZXNjZW5kYW50LT5pc0Zsb2F0aW5nT3JPdXRPZkZsb3dQb3NpdGlvbmVkKCkpCkBA IC0zODYsOSArMzgyLDEwIEBAIHZvaWQgUmVuZGVyTXVsdGlDb2x1bW5GbG93VGhyZWFkOjpmbG93 VGgKICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAvLyBXZSBoYXZlIHRvIG51a2Ug dGhlIHBsYWNlaG9sZGVyLCBzaW5jZSB0aGUgYW5jZXN0b3IgYWxyZWFkeSBsb3N0IHRoZSBtYXBw aW5nIHRvIGl0IHdoZW4KICAgICAgICAgICAgICAgICAvLyB3ZSBzaGlmdGVkIHRoZSBwbGFjZWhv bGRlciBkb3duIGludG8gdGhpcyBmbG93IHRocmVhZC4KLSAgICAgICAgICAgICAgICBhbmNlc3Rv ckJsb2NrLm11bHRpQ29sdW1uRmxvd1RocmVhZCgpLT5oYW5kbGVTcGFubmVyUmVtb3ZhbChzcGFu bmVyKTsKLSAgICAgICAgICAgICAgICBwbGFjZWhvbGRlci5kZXN0cm95KCk7Ci0gICAgICAgICAg ICAgICAgCisgICAgICAgICAgICAgICAgaWYgKHN1YnRyZWVSb290ID09IGRlc2NlbmRhbnQpCisg ICAgICAgICAgICAgICAgICAgIHN1YnRyZWVSb290ID0gc3Bhbm5lcjsKKyAgICAgICAgICAgICAg ICBwbGFjZWhvbGRlci5wYXJlbnQoKS0+cmVtb3ZlQ2hpbGQocGxhY2Vob2xkZXIpOworCiAgICAg ICAgICAgICAgICAgLy8gTm93IHdlIHByb2Nlc3MgdGhlIHNwYW5uZXIuCiAgICAgICAgICAgICAg ICAgZGVzY2VuZGFudCA9IHByb2Nlc3NQb3NzaWJsZVNwYW5uZXJEZXNjZW5kYW50KHN1YnRyZWVS b290LCBzcGFubmVyKTsKICAgICAgICAgICAgICAgICBjb250aW51ZTsKSW5kZXg6IExheW91dFRl c3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlz aW9uIDE3NTU5MikKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAt MSwzICsxLDE0IEBACisyMDE0LTExLTA0ICBEYXZpZCBIeWF0dCAgPGh5YXR0QGFwcGxlLmNvbT4K KworICAgICAgICBEZXNjZW5kYW50IGVuZHMgdXAgaW4gd3JvbmcgZmxvdyB0aHJlYWQgd2l0aCBu ZXN0ZWQgY29sdW1ucyBhbmQgc3BhbnMuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn L3Nob3dfYnVnLmNnaT9pZD0xMzcyNzMKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KKworICAgICAgICBVbnNraXBwZWQgdGhlIHR3byBwcm9ibGVtYXRpYyBzcGFuIHRlc3Rz LgorCisgICAgICAgICogVGVzdEV4cGVjdGF0aW9uczoKKwogMjAxNC0xMS0wNCAgTWljaGFlbCBT YWJvZmYgIDxtc2Fib2ZmQGFwcGxlLmNvbT4KIAogICAgICAgICBEaXNhYmxlIGZsYWtleSBkZmct aW50OGFycmF5LmpzIGFuZCBkZmctaW50MTZhcnJheS5qcyB0ZXN0cyBmb3IgQVJNNjQKSW5kZXg6 IExheW91dFRlc3RzL1Rlc3RFeHBlY3RhdGlvbnMKPT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMv VGVzdEV4cGVjdGF0aW9ucwkocmV2aXNpb24gMTc1NTU2KQorKysgTGF5b3V0VGVzdHMvVGVzdEV4 cGVjdGF0aW9ucwkod29ya2luZyBjb3B5KQpAQCAtMTA0LDggKzEwNCw2IEBAIHdlYmtpdC5vcmcv Yi83NDE0NCBmYXN0L3JlZ2lvbnMvcmVnaW9uLWMKICMgRXhwYW5kbyBwcm9wZXJ0aWVzIG9uIGF0 dHJpYnV0ZSBub2RlcyBkaXNhcHBlYXIKIHdlYmtpdC5vcmcvYi84ODA0NSBmYXN0L2RvbS9nYy1h dHRyaWJ1dGUtbm9kZS5odG1sIFsgRmFpbHVyZSBQYXNzIF0KIAotd2Via2l0Lm9yZy9iLzEzNzMx NiBmYXN0L211bHRpY29sL25ld211bHRpY29sL3NwYW5uZXItY3Jhc2guaHRtbCBbIENyYXNoIFBh c3MgXQotCiAjIFRoZXNlIHRlc3RzIGFyZSBpbmNvcnJlY3QgaW4gdGhlIENTUyB0ZXN0IHN1aXRl IGFuZCBzaG91bGQgYmUgZml4ZWQgdGhlcmUgZmlyc3QuCiBjc3MyLjEvMjAxMTAzMjMvcmVwbGFj ZWQtaW50cmluc2ljLTAwMS5odG0gWyBGYWlsdXJlIF0KIGNzczIuMS8yMDExMDMyMy9yZXBsYWNl ZC1pbnRyaW5zaWMtMDAyLmh0bSBbIEZhaWx1cmUgXQpAQCAtMjM5LDcgKzIzNyw1IEBAIHdlYmtp dC5vcmcvYi8xMzc4ODMgdHJhbnNpdGlvbnMvY29sb3ItdHIKIHdlYmtpdC5vcmcvYi8xMzc4ODMg dHJhbnNpdGlvbnMvY29sb3ItdHJhbnNpdGlvbi1yb3VuZGluZy5odG1sIFsgRmFpbHVyZSBQYXNz IF0KIHdlYmtpdC5vcmcvYi8xMzc4ODMgdHJhbnNpdGlvbnMvY3JlYXRlZC13aGlsZS1zdXNwZW5k ZWQuaHRtbCBbIEZhaWx1cmUgUGFzcyBdCiAKLXdlYmtpdC5vcmcvYi8xMzgxNDUgZmFzdC9tdWx0 aWNvbC9tdWx0aWNvbC1jcmF6eS1uZXN0aW5nLmh0bWwgWyBTa2lwIF0KLQogIyBUZW1wb3Jhcmls eSB0dXJuIHRoaXMgb2ZmLiBCYWNrIG9uIHNvb24uCiB3ZWJraXQub3JnL2IvMTM4MzU4IGh0dHAv dGVzdHMvbXVsdGlwYXJ0L3N0b3AtY3Jhc2guaHRtbCBbIFNraXAgXQo=