|Summary:||REGRESSION: ASSERTION FAILED: i < size() in Vector.h:401 on zero -webkit-column-count|
|Product:||WebKit||Reporter:||David Kilzer (:ddkilzer) <ddkilzer>|
|Component:||Layout and Rendering||Assignee:||Nobody <webkit-unassigned>|
|Priority:||P1||Keywords:||HasReduction, InRadar, Regression|
|Version:||523.x (Safari 3)|
|OS:||OS X 10.4|
Description David Kilzer (:ddkilzer) 2007-07-22 20:12:18 PDT
* SUMMARY iExploder test #13774 causes an assertion failure in debug builds of ToT WebKit. This is the same assertion failure as Bug 14714, but has a different test case. * STEPS TO REPRODUCE 1. Launch Safari/WebKit. 2. Open test case. * RESULTS Safari crashes. * REGRESSION This does not occur on the Safari 3.0 (522.12) public beta with its original WebKit on Mac OS X 10.4.10 (8R218). Tested with a local debug build of WebKit r24513 with Safari 3.0 (522.12) on Mac OS X 10.4.10 (8R218). * NOTES May be related to Bug 14714.
Comment 1 David Kilzer (:ddkilzer) 2007-07-22 20:14:25 PDT
Created attachment 15640 [details] Original iExploder test #13774
Comment 2 David Kilzer (:ddkilzer) 2007-07-22 20:15:34 PDT
Created attachment 15641 [details] Reduced test case
Comment 4 Beth Dakin 2007-07-24 11:15:19 PDT
As I commented in http://bugs.webkit.org/show_bug.cgi?id=14714, Hyatt has mentioned that he would really like to pull our current implementation of column layout before Leopard ships. I wonder if that is how he will want to fix this bug. Looking into it in the meantime anyway.