Bug 136365

Summary: ASSERTION FAILED: count >= 1 in WebCore::RenderMultiColumnSet::columnCount
Product: WebKit Reporter: Renata Hodovan <rhodovan.u-szeged>
Component: Layout and RenderingAssignee: zalan <zalan>
Status: RESOLVED FIXED    
Severity: Normal CC: bfulgham, commit-queue, hyatt, mstensho, simon.fraser, webkit-bug-importer, zalan
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 116980    
Attachments:
Description Flags
Test case
none
Repro 2
none
Patch none

Renata Hodovan
Reported 2014-08-29 04:54:09 PDT
Created attachment 237343 [details] Test case The failing test case: <!DOCTYPE html> <CITE> <object></object> </CITE> <style> * { padding-right: 3%; -webkit-column-count: 2; padding-top: 17902000vh; } </style> Backtrace: ASSERTION FAILED: count >= 1 /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderMultiColumnSet.cpp(443) : unsigned int WebCore::RenderMultiColumnSet::columnCount() const 1 0x7ffff3ef343b WTFCrash 2 0x7ffff3037e76 WebCore::RenderMultiColumnSet::columnCount() const 3 0x7ffff303a580 WebCore::RenderMultiColumnSet::addOverflowFromChildren() 4 0x7ffff2ed2a79 WebCore::RenderBlock::computeOverflow(WebCore::LayoutUnit, bool) 5 0x7ffff2f06e6b WebCore::RenderBlockFlow::computeOverflow(WebCore::LayoutUnit, bool) 6 0x7ffff2effb85 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 7 0x7ffff2ed25af WebCore::RenderBlock::layout() 8 0x7ffff3037b17 WebCore::RenderMultiColumnSet::layout() 9 0x7ffff2f00790 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 10 0x7ffff2f002b1 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 11 0x7ffff2eff6ce WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 12 0x7ffff2f0e46b WebCore::RenderBlockFlow::relayoutForPagination(WebCore::LayoutStateMaintainer&) 13 0x7ffff2eff816 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 14 0x7ffff2ed25af WebCore::RenderBlock::layout() 15 0x7ffff2f00790 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 16 0x7ffff2f002b1 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 17 0x7ffff2eff6ce WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 18 0x7ffff2ed25af WebCore::RenderBlock::layout() 19 0x7ffff2f8d874 WebCore::RenderFlowThread::layout() 20 0x7ffff303113c WebCore::RenderMultiColumnFlowThread::layout() 21 0x7ffff2f0eb86 WebCore::RenderBlockFlow::layoutSpecialExcludedChild(bool) 22 0x7ffff2f0017a WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 23 0x7ffff2eff6ce WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 24 0x7ffff2ed25af WebCore::RenderBlock::layout() 25 0x7ffff2f00790 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 26 0x7ffff2f002b1 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 27 0x7ffff2eff6ce WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 28 0x7ffff2ed25af WebCore::RenderBlock::layout() 29 0x7ffff30bd207 WebCore::RenderView::layoutContent(WebCore::LayoutState const&) 30 0x7ffff30bd8d7 WebCore::RenderView::layout() 31 0x7ffff2cfd2e5 WebCore::FrameView::layout(bool) Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fff91255700 (LWP 17731)] 0x00007ffff3ef3440 in WTFCrash () at /home/reni/data/REPOS/webkit/Source/WTF/wtf/Assertions.cpp:329 329 *(int *)(uintptr_t)0xbbadbeef = 0; #0 0x00007ffff3ef3440 in WTFCrash () at /home/reni/data/REPOS/webkit/Source/WTF/wtf/Assertions.cpp:329 #1 0x00007ffff3037e76 in WebCore::RenderMultiColumnSet::columnCount (this=0x7ff210) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderMultiColumnSet.cpp:443 #2 0x00007ffff303a580 in WebCore::RenderMultiColumnSet::addOverflowFromChildren (this=0x7ff210) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderMultiColumnSet.cpp:868 #3 0x00007ffff2ed2a79 in WebCore::RenderBlock::computeOverflow (this=0x7ff210, oldClientAfterEdge=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlock.cpp:1102 #4 0x00007ffff2f06e6b in WebCore::RenderBlockFlow::computeOverflow (this=0x7ff210, oldClientAfterEdge=..., recomputeFloats=false) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:2080 #5 0x00007ffff2effb85 in WebCore::RenderBlockFlow::layoutBlock (this=0x7ff210, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:527 #6 0x00007ffff2ed25af in WebCore::RenderBlock::layout (this=0x7ff210) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlock.cpp:1019 #7 0x00007ffff3037b17 in WebCore::RenderMultiColumnSet::layout (this=0x7ff210) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderMultiColumnSet.cpp:388 #8 0x00007ffff2f00790 in WebCore::RenderBlockFlow::layoutBlockChild (this=0x7118d0, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:711 #9 0x00007ffff2f002b1 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x7118d0, relayoutChildren=true, maxFloatLogicalBottom=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:632 #10 0x00007ffff2eff6ce in WebCore::RenderBlockFlow::layoutBlock (this=0x7118d0, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:485 #11 0x00007ffff2f0e46b in WebCore::RenderBlockFlow::relayoutForPagination (this=0x7118d0, statePusher=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:3390 #12 0x00007ffff2eff816 in WebCore::RenderBlockFlow::layoutBlock (this=0x7118d0, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:492 #13 0x00007ffff2ed25af in WebCore::RenderBlock::layout (this=0x7118d0) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlock.cpp:1019 #14 0x00007ffff2f00790 in WebCore::RenderBlockFlow::layoutBlockChild (this=0x7b03a0, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:711 #15 0x00007ffff2f002b1 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x7b03a0, relayoutChildren=false, maxFloatLogicalBottom=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:632 #16 0x00007ffff2eff6ce in WebCore::RenderBlockFlow::layoutBlock (this=0x7b03a0, relayoutChildren=false, pageLogicalHeight=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:485 #17 0x00007ffff2ed25af in WebCore::RenderBlock::layout (this=0x7b03a0) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlock.cpp:1019 #18 0x00007ffff2f8d874 in WebCore::RenderFlowThread::layout (this=0x7b03a0) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderFlowThread.cpp:201 #19 0x00007ffff303113c in WebCore::RenderMultiColumnFlowThread::layout (this=0x7b03a0) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp:135 #20 0x00007ffff2f0eb86 in WebCore::RenderBlockFlow::layoutSpecialExcludedChild (this=0x6e2bd0, relayoutChildren=true) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:3627 #21 0x00007ffff2f0017a in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x6e2bd0, relayoutChildren=true, maxFloatLogicalBottom=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:604 #22 0x00007ffff2eff6ce in WebCore::RenderBlockFlow::layoutBlock (this=0x6e2bd0, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:485 #23 0x00007ffff2ed25af in WebCore::RenderBlock::layout (this=0x6e2bd0) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlock.cpp:1019 #24 0x00007ffff2f00790 in WebCore::RenderBlockFlow::layoutBlockChild (this=0x73b3a0, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:711 #25 0x00007ffff2f002b1 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x73b3a0, relayoutChildren=true, maxFloatLogicalBottom=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:632 #26 0x00007ffff2eff6ce in WebCore::RenderBlockFlow::layoutBlock (this=0x73b3a0, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:485 #27 0x00007ffff2ed25af in WebCore::RenderBlock::layout (this=0x73b3a0) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlock.cpp:1019 #28 0x00007ffff30bd207 in WebCore::RenderView::layoutContent (this=0x73b3a0, state=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderView.cpp:232 #29 0x00007ffff30bd8d7 in WebCore::RenderView::layout (this=0x73b3a0) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderView.cpp:357 #30 0x00007ffff2cfd2e5 in WebCore::FrameView::layout (this=0x6e0a80, allowSubtree=true) at /home/reni/data/REPOS/webkit/Source/WebCore/page/FrameView.cpp:1301 #31 0x00007ffff27e806b in WebCore::Document::implicitClose (this=0x70f290) at /home/reni/data/REPOS/webkit/Source/WebCore/dom/Document.cpp:2440 #32 0x00007ffff2bc4749 in WebCore::FrameLoader::checkCallImplicitClose (this=0x6cfdf8) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/FrameLoader.cpp:898 #33 0x00007ffff2bc44b1 in WebCore::FrameLoader::checkCompleted (this=0x6cfdf8) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/FrameLoader.cpp:844 #34 0x00007ffff2bc421a in WebCore::FrameLoader::finishedParsing (this=0x6cfdf8) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/FrameLoader.cpp:764 #35 0x00007ffff27f0aed in WebCore::Document::finishedParsing (this=0x70f290) at /home/reni/data/REPOS/webkit/Source/WebCore/dom/Document.cpp:4523 #36 0x00007ffff39011b9 in WebCore::HTMLConstructionSite::finishedParsing (this=0x781398) at /home/reni/data/REPOS/webkit/Source/WebCore/html/parser/HTMLConstructionSite.cpp:395 #37 0x00007ffff2adf389 in WebCore::HTMLTreeBuilder::finished (this=0x781380) at /home/reni/data/REPOS/webkit/Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2997 #38 0x00007ffff2ab1028 in WebCore::HTMLDocumentParser::end (this=0x6b9500) at /home/reni/data/REPOS/webkit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:451 #39 0x00007ffff2ab1113 in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd (this=0x6b9500) at /home/reni/data/REPOS/webkit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:462 #40 0x00007ffff2aafac9 in WebCore::HTMLDocumentParser::prepareToStopParsing (this=0x6b9500) at /home/reni/data/REPOS/webkit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:165 #41 0x00007ffff2ab1156 in WebCore::HTMLDocumentParser::attemptToEnd (this=0x6b9500) at /home/reni/data/REPOS/webkit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:474 #42 0x00007ffff2ab120d in WebCore::HTMLDocumentParser::finish (this=0x6b9500) at /home/reni/data/REPOS/webkit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:502 #43 0x00007ffff2bb5911 in WebCore::DocumentWriter::end (this=0x783e60) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/DocumentWriter.cpp:250 #44 0x00007ffff2ba0ea7 in WebCore::DocumentLoader::finishedLoading (this=0x783dc0, finishTime=0) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/DocumentLoader.cpp:441 #45 0x00007ffff2ba0c10 in WebCore::DocumentLoader::notifyFinished (this=0x783dc0, resource=0x79eb80) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/DocumentLoader.cpp:375 #46 0x00007ffff2c54952 in WebCore::CachedResource::checkNotify (this=0x79eb80) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/cache/CachedResource.cpp:333 #47 0x00007ffff2c54a5c in WebCore::CachedResource::finishLoading (this=0x79eb80) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/cache/CachedResource.cpp:349 #48 0x00007ffff2c5138a in WebCore::CachedRawResource::finishLoading (this=0x79eb80, data=0x6c2e10) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/cache/CachedRawResource.cpp:101 #49 0x00007ffff2c0452c in WebCore::SubresourceLoader::didFinishLoading (this=0x79f0e0, finishTime=0) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/SubresourceLoader.cpp:306 #50 0x00007ffff2c001bb in WebCore::ResourceLoader::didFinishLoading (this=0x79f0e0, finishTime=0) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/ResourceLoader.cpp:512 #51 0x00007ffff339390d in WebCore::readCallback (asyncResult=0x7a29f0, data=0x79f710) at /home/reni/data/REPOS/webkit/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1302 #52 0x00007fffeb3c1816 in async_ready_callback_wrapper (source_object=0x6c4db0, res=0x7a29f0, user_data=user_data@entry=0x79f710) at ginputstream.c:523 #53 0x00007fffeb3e7115 in g_task_return_now (task=0x7a29f0) at gtask.c:1077 #54 0x00007fffeb3e7139 in complete_in_idle_cb (task=0x7a29f0) at gtask.c:1086 #55 0x00007fffeae23a7d in g_main_dispatch (context=0x6bc390) at gmain.c:3064 #56 g_main_context_dispatch (context=context@entry=0x6bc390) at gmain.c:3663 #57 0x00007fffec6875e0 in _ecore_glib_select__locked (ecore_timeout=<optimized out>, efds=<optimized out>, wfds=0x7fffffffd5d0, rfds=0x7fffffffd550, ecore_fds=10, ctx=<optimized out>) at lib/ecore/ecore_glib.c:172 #58 _ecore_glib_select (ecore_fds=10, rfds=0x7fffffffd550, wfds=0x7fffffffd5d0, efds=<optimized out>, ecore_timeout=<optimized out>) at lib/ecore/ecore_glib.c:204 #59 0x00007fffec689ff4 in _ecore_main_select (timeout=<optimized out>) at lib/ecore/ecore_main.c:1579 #60 0x00007fffec68a995 in _ecore_main_loop_iterate_internal (once_only=once_only@entry=0) at lib/ecore/ecore_main.c:2005 #61 0x00007fffec68aa57 in ecore_main_loop_begin () at lib/ecore/ecore_main.c:1042 #62 0x00007ffff3f38db5 in WTF::RunLoop::run () at /home/reni/data/REPOS/webkit/Source/WTF/wtf/efl/RunLoopEfl.cpp:51 #63 0x00007ffff207062a in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffda78) at /home/reni/data/REPOS/webkit/Source/WebKit2/Shared/unix/ChildProcessMain.h:61 #64 0x00007ffff2070408 in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffda78) at /home/reni/data/REPOS/webkit/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp:124 #65 0x000000000040084d in main (argc=2, argv=0x7fffffffda78) at /home/reni/data/REPOS/webkit/Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:32
Attachments
Test case (150 bytes, text/html)
2014-08-29 04:54 PDT, Renata Hodovan 		no flags
Details
Repro 2 (68 bytes, text/html)
2015-02-10 07:55 PST, Renata Hodovan 		no flags
Details
Patch (3.49 KB, patch)
2016-12-07 14:14 PST, zalan 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Renata Hodovan
Comment 1 2015-01-29 06:37:32 PST
I can't repro this anymore.
Renata Hodovan
Comment 2 2015-02-10 07:55:45 PST
Created attachment 246325 [details] Repro 2 Reopening the bug since the new test case still produces the failure.
Renata Hodovan
Comment 3 2015-02-10 07:56:55 PST
Reopening...
Brent Fulgham
Comment 4 2016-08-03 14:58:46 PDT
This reproduces in r204037.
Radar WebKit Bug Importer
Comment 5 2016-08-03 15:03:40 PDT
<rdar://problem/27686727>
zalan
Comment 6 2016-12-07 14:14:58 PST
Created attachment 296421 [details] Patch
WebKit Commit Bot
Comment 7 2016-12-07 15:21:56 PST
Comment on attachment 296421 [details] Patch Clearing flags on attachment: 296421 Committed r209487: <http://trac.webkit.org/changeset/209487>
WebKit Commit Bot
Comment 8 2016-12-07 15:22:01 PST
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.