Bug 14718

Summary: REGRESSION: ASSERTION FAILED: i < size() in Vector.h:401 on zero -webkit-column-count
Product: WebKit Reporter: David Kilzer (:ddkilzer) <ddkilzer>
Component: Layout and RenderingAssignee: Nobody <webkit-unassigned>
Status: RESOLVED DUPLICATE    
Severity: Normal CC: bdakin
Priority: P1 Keywords: HasReduction, InRadar, Regression
Version: 523.x (Safari 3)   
Hardware: Mac   
OS: OS X 10.4   
Attachments:
Description Flags
Original iExploder test #13774
none
Reduced test case none

Description David Kilzer (:ddkilzer) 2007-07-22 20:12:18 PDT 
* SUMMARY
iExploder test #13774 causes an assertion failure in debug builds of ToT WebKit.  This is the same assertion failure as Bug 14714, but has a different test case.

* STEPS TO REPRODUCE
1. Launch Safari/WebKit.
2. Open test case.

* RESULTS
Safari crashes.

* REGRESSION
This does not occur on the Safari 3.0 (522.12) public beta with its original WebKit on Mac OS X 10.4.10 (8R218).

Tested with a local debug build of WebKit r24513 with Safari 3.0 (522.12) on Mac OS X 10.4.10 (8R218).

* NOTES
May be related to Bug 14714.
Comment 1 David Kilzer (:ddkilzer) 2007-07-22 20:14:25 PDT 
Created attachment 15640 [details]
Original iExploder test #13774
Comment 2 David Kilzer (:ddkilzer) 2007-07-22 20:15:34 PDT 
Created attachment 15641 [details]
Reduced test case
Comment 3 David Kilzer (:ddkilzer) 2007-07-22 20:17:17 PDT 
<rdar://problem/5353207>
Comment 4 Beth Dakin 2007-07-24 11:15:19 PDT 
As I commented in http://bugs.webkit.org/show_bug.cgi?id=14714, Hyatt has mentioned that he would really like to pull our current implementation of column layout before Leopard ships. I wonder if that is how he will want to fix this bug. Looking into it in the meantime anyway.
Comment 5 Beth Dakin 2007-07-24 12:07:00 PDT 
Fixed with r24599...same as http://bugs.webkit.org/show_bug.cgi?id=14714

*** This bug has been marked as a duplicate of 14714 ***