139045 2014-11-25 08:54:56 -0800 ASSERTION FAILED: multiColumnFlowThread()->findColumnSpannerPlaceholder(next) in WebCore::RenderMultiColumnSet::requiresBalancing 2016-08-04 10:23:13 -0700 1 1 1 Unclassified WebKit Tables 528+ (Nightly build) Unspecified Unspecified RESOLVED WORKSFORME P2 Normal --- 116980 1 rhodovan.u-szeged webkit-unassigned bfulgham hyatt oldest_to_newest 1051012 0 242198 rhodovan.u-szeged 2014-11-25 08:54:56 -0800 Created attachment 242198 Test case Load the following test with debug WebKit (supplying the doctype would solve the issue): <style> * { column-span:all; -webkit-columns:1095pc; opacity:inherit; display:compact; -webkit-perspective:9429vmin; } </style> <table align="left"> <col></col> </table> Backtrace: ASSERTION FAILED: multiColumnFlowThread()->findColumnSpannerPlaceholder(next) ../../Source/WebCore/rendering/RenderMultiColumnSet.cpp(320) : bool WebCore::RenderMultiColumnSet::requiresBalancing() const Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fff98c4e700 (LWP 4246)] 0x00007fffedc7ea89 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 321 *(int *)(uintptr_t)0xbbadbeef = 0; #0 0x00007fffedc7ea89 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 #1 0x00007ffff3b1b2ae in WebCore::RenderMultiColumnSet::requiresBalancing (this=0x8c2360) at ../../Source/WebCore/rendering/RenderMultiColumnSet.cpp:320 #2 0x00007ffff3b1b3cf in WebCore::RenderMultiColumnSet::prepareForLayout (this=0x8c2360, initial=true) at ../../Source/WebCore/rendering/RenderMultiColumnSet.cpp:340 #3 0x00007ffff39e3f3c in WebCore::RenderBlockFlow::layoutSpecialExcludedChild (this=0x7170e0, relayoutChildren=false) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:3677 #4 0x00007ffff39d4ed4 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x7170e0, relayoutChildren=false, maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:592 #5 0x00007ffff39d4438 in WebCore::RenderBlockFlow::layoutBlock (this=0x7170e0, relayoutChildren=false, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:473 #6 0x00007ffff39aa07f in WebCore::RenderBlock::layout (this=0x7170e0) at ../../Source/WebCore/rendering/RenderBlock.cpp:931 #7 0x00007ffff39d54ee in WebCore::RenderBlockFlow::layoutBlockChild (this=0x610960, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:699 #8 0x00007ffff39d500b in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x610960, relayoutChildren=false, maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:620 #9 0x00007ffff39d4438 in WebCore::RenderBlockFlow::layoutBlock (this=0x610960, relayoutChildren=false, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:473 #10 0x00007ffff39aa07f in WebCore::RenderBlock::layout (this=0x610960) at ../../Source/WebCore/rendering/RenderBlock.cpp:931 #11 0x00007ffff39d54ee in WebCore::RenderBlockFlow::layoutBlockChild (this=0x65dc00, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:699 #12 0x00007ffff39d500b in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x65dc00, relayoutChildren=false, maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:620 #13 0x00007ffff39d4438 in WebCore::RenderBlockFlow::layoutBlock (this=0x65dc00, relayoutChildren=false, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:473 #14 0x00007ffff39aa07f in WebCore::RenderBlock::layout (this=0x65dc00) at ../../Source/WebCore/rendering/RenderBlock.cpp:931 #15 0x00007ffff3b9f89b in WebCore::RenderView::layoutContent (this=0x65dc00, state=...) at ../../Source/WebCore/rendering/RenderView.cpp:232 #16 0x00007ffff3b9ff6b in WebCore::RenderView::layout (this=0x65dc00) at ../../Source/WebCore/rendering/RenderView.cpp:357 #17 0x00007ffff3711889 in WebCore::FrameView::layout (this=0x64c740, allowSubtree=true) at ../../Source/WebCore/page/FrameView.cpp:1313 #18 0x00007ffff371acbb in WebCore::FrameView::updateLayoutAndStyleIfNeededRecursive (this=0x64c740) at ../../Source/WebCore/page/FrameView.cpp:3935 #19 0x00007ffff2ab53cc in WebKit::WebPage::layoutIfNeeded (this=0x5c92e0) at ../../Source/WebKit2/WebProcess/WebPage/WebPage.cpp:1220 #20 0x00007ffff2ba8f22 in WebKit::DrawingAreaImpl::display (this=0x65d740, updateInfo=...) at ../../Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp:589 #21 0x00007ffff2ba8c0e in WebKit::DrawingAreaImpl::display (this=0x65d740) at ../../Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp:550 #22 0x00007ffff2ba8acc in WebKit::DrawingAreaImpl::displayTimerFired (this=0x65d740) at ../../Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp:529 #23 0x00007ffff2baaf8b in WTF::RunLoop::Timer<WebKit::DrawingAreaImpl>::fired (this=0x65d938) at ../../Source/WTF/wtf/RunLoop.h:121 #24 0x00007ffff464b93b in WTF::RunLoop::TimerBase::__lambda1::operator() (__closure=0x600660) at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:121 #25 0x00007ffff464bde1 in std::_Function_handler<bool(), WTF::RunLoop::TimerBase::start(double, bool)::__lambda1>::_M_invoke(const std::_Any_data &) (__functor=...) at /usr/include/c++/4.8/functional:2057 #26 0x00007ffff464afc2 in std::function<bool ()>::operator()() const (this=0x7fffffffd5c8) at /usr/include/c++/4.8/functional:2464 #27 0x00007fffedcc861c in WTF::GMainLoopSource::boolCallback (this=0x65d948) at ../../Source/WTF/wtf/gobject/GMainLoopSource.cpp:405 #28 0x00007fffedcc8a91 in WTF::GMainLoopSource::boolSourceCallback (source=0x65d948, source@entry=<error reading variable: value has been optimized out>) at ../../Source/WTF/wtf/gobject/GMainLoopSource.cpp:462 #29 0x00007fffeaaff453 in g_timeout_dispatch (source=0x58c680, callback=<optimized out>, user_data=<optimized out>) at gmain.c:4472 #30 0x00007fffeaafea2d in g_main_dispatch (context=0x478020) at gmain.c:3064 #31 g_main_context_dispatch (context=context@entry=0x478020) at gmain.c:3663 #32 0x00007fffeaafed98 in g_main_context_iterate (context=0x478020, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3734 #33 0x00007fffeaaff05a in g_main_loop_run (loop=0x9015f0) at gmain.c:3928 #34 0x00007ffff464b42e in WTF::RunLoop::run () at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:59 #35 0x00007ffff2bb8250 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffd968) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61 #36 0x00007ffff2bb80b5 in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffd968) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:73 #37 0x0000000000400891 in main (argc=2, argv=0x7fffffffd968) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:44 1217454 1 bfulgham 2016-08-04 10:23:13 -0700 This issue no longer happens in r204037 under GuardMalloc or ASAN. If you believe there is still an issue, please reopen this bug with a revised test case. 242198 2014-11-25 08:54:56 -0800 2014-11-25 08:54:56 -0800 Test case crash.html text/html 193 rhodovan.u-szeged PHN0eWxlPgoqIHsKICAgIGNvbHVtbi1zcGFuOmFsbDsKICAgIC13ZWJraXQtY29sdW1uczoxMDk1 cGM7CiAgICBvcGFjaXR5OmluaGVyaXQ7CiAgICBkaXNwbGF5OmNvbXBhY3Q7CiAgICAtd2Via2l0 LXBlcnNwZWN0aXZlOjk0Mjl2bWluOwp9Cjwvc3R5bGU+Cjx0YWJsZSBhbGlnbj0ibGVmdCI+CiAg ICA8Y29sPjwvY29sPgo8L3RhYmxlPg==