Bug 14718

Summary: REGRESSION: ASSERTION FAILED: i < size() in Vector.h:401 on zero -webkit-column-count
Product: WebKit Reporter: David Kilzer (:ddkilzer) <ddkilzer>
Component: Layout and RenderingAssignee: Nobody <webkit-unassigned>
Severity: Normal CC: bdakin
Priority: P1 Keywords: HasReduction, InRadar, Regression
Version: 523.x (Safari 3)   
Hardware: Mac   
OS: OS X 10.4   
Description Flags
Original iExploder test #13774
Reduced test case none

Description David Kilzer (:ddkilzer) 2007-07-22 20:12:18 PDT
iExploder test #13774 causes an assertion failure in debug builds of ToT WebKit.  This is the same assertion failure as Bug 14714, but has a different test case.

1. Launch Safari/WebKit.
2. Open test case.

Safari crashes.

This does not occur on the Safari 3.0 (522.12) public beta with its original WebKit on Mac OS X 10.4.10 (8R218).

Tested with a local debug build of WebKit r24513 with Safari 3.0 (522.12) on Mac OS X 10.4.10 (8R218).

May be related to Bug 14714.
Comment 1 David Kilzer (:ddkilzer) 2007-07-22 20:14:25 PDT
Created attachment 15640 [details]
Original iExploder test #13774
Comment 2 David Kilzer (:ddkilzer) 2007-07-22 20:15:34 PDT
Created attachment 15641 [details]
Reduced test case
Comment 3 David Kilzer (:ddkilzer) 2007-07-22 20:17:17 PDT
Comment 4 Beth Dakin 2007-07-24 11:15:19 PDT
As I commented in http://bugs.webkit.org/show_bug.cgi?id=14714, Hyatt has mentioned that he would really like to pull our current implementation of column layout before Leopard ships. I wonder if that is how he will want to fix this bug. Looking into it in the meantime anyway.
Comment 5 Beth Dakin 2007-07-24 12:07:00 PDT
Fixed with r24599...same as http://bugs.webkit.org/show_bug.cgi?id=14714

*** This bug has been marked as a duplicate of 14714 ***