Bug 137273 – Descendant is being put into the wrong flow thread with nested columns and spans

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[Dave Hyatt]

Descendant is being put into the wrong flow thread with nested columns and spans. See the FIXME in isValidColumnSpanner in RenderMultiColumnFlowThread.cpp.

[Dave Hyatt]

Created attachment 240986 [details]
Patch

[Simon Fraser (smfr)]

Comment on attachment 240986 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=240986&action=review

> Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp:387
> +                placeholder.parent()->removeChild(placeholder);

I think you want a "// FIXME: placeholder is leaked" here.

[David Kilzer (:ddkilzer)]

Comment on attachment 240986 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=240986&action=review

> Source/WebCore/ChangeLog:20
> +        The second fix was to stop destroying the placeholder. Since the placeholder can just have been inserted, you
> +        can't delete it, since otherwise code further up the stack will access the deleted object. For now, we just
> +        leak the placeholder.

Would using a RenderPtr<> for the placeholder (née descendant) fix the leak/object lifetime?

>> Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp:387
>> -                ancestorBlock.multiColumnFlowThread()->handleSpannerRemoval(spanner);
>> -                placeholder.destroy();
>> -                
>> +                if (subtreeRoot == descendant)
>> +                    subtreeRoot = spanner;
>> +                placeholder.parent()->removeChild(placeholder);
> 
> I think you want a "// FIXME: placeholder is leaked" here.

And a new bug number that tracks the leak please.

[Dave Hyatt]

Fixed in r175641.

[Radar WebKit Bug Importer]

<rdar://problem/18885189>

[David Kilzer (:ddkilzer)]

*** Bug 137316 has been marked as a duplicate of this bug. ***