Created attachment 235968 [details] Test case The following test causes the assertion failure: <style> * { display:table-cell; -webkit-column-count:3; } </style> Backtrace: ASSERTION FAILED: !needsLayout() ../../Source/WebCore/rendering/RenderTableSection.cpp(669) : void WebCore::RenderTableSection::layoutRows() ... Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fff97334700 (LWP 28215)] 0x00007ffff30191c8 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329 329 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff30191c8 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329 #1 0x00007ffff3efcbb4 in WebCore::RenderTableSection::layoutRows (this=0x8075d0) at ../../Source/WebCore/rendering/RenderTableSection.cpp:669 #2 0x00007ffff3ee654e in WebCore::RenderTable::layout (this=0x8072d0) at ../../Source/WebCore/rendering/RenderTable.cpp:525 #3 0x00007ffff3d7b918 in WebCore::RenderBlockFlow::layoutBlockChild (this=0x91d860, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:713 #4 0x00007ffff3d7b45a in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x91d860, relayoutChildren=false, maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:632 #5 0x00007ffff3d7a958 in WebCore::RenderBlockFlow::layoutBlock (this=0x91d860, relayoutChildren=false, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:485 #6 0x00007ffff3d50987 in WebCore::RenderBlock::layout (this=0x91d860) at ../../Source/WebCore/rendering/RenderBlock.cpp:1018 #7 0x00007ffff3e06af7 in WebCore::RenderFlowThread::layout (this=0x91d860) at ../../Source/WebCore/rendering/RenderFlowThread.cpp:201 #8 0x00007ffff3ea57be in WebCore::RenderMultiColumnFlowThread::layout (this=0x91d860) at ../../Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp:135 #9 0x00007ffff3d8908a in WebCore::RenderBlockFlow::layoutSpecialExcludedChild (this=0x7da2c0, relayoutChildren=true) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:3629 #10 0x00007ffff3d7b338 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x7da2c0, relayoutChildren=true, maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:604 #11 0x00007ffff3d7a958 in WebCore::RenderBlockFlow::layoutBlock (this=0x7da2c0, relayoutChildren=true, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:485 #12 0x00007ffff3d50987 in WebCore::RenderBlock::layout (this=0x7da2c0) at ../../Source/WebCore/rendering/RenderBlock.cpp:1018 #13 0x00007ffff3d7b918 in WebCore::RenderBlockFlow::layoutBlockChild (this=0x820690, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:713 #14 0x00007ffff3d7b45a in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x820690, relayoutChildren=true, maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:632 #15 0x00007ffff3d7a958 in WebCore::RenderBlockFlow::layoutBlock (this=0x820690, relayoutChildren=true, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:485 #16 0x00007ffff3d50987 in WebCore::RenderBlock::layout (this=0x820690) at ../../Source/WebCore/rendering/RenderBlock.cpp:1018 #17 0x00007ffff3f28aad in WebCore::RenderView::layoutContent (this=0x820690, state=...) at ../../Source/WebCore/rendering/RenderView.cpp:232 #18 0x00007ffff3f29166 in WebCore::RenderView::layout (this=0x820690) at ../../Source/WebCore/rendering/RenderView.cpp:357 #19 0x00007ffff3acf1f4 in WebCore::FrameView::layout (this=0xa097b0, allowSubtree=true) at ../../Source/WebCore/page/FrameView.cpp:1282 #20 0x00007ffff353f72f in WebCore::Document::implicitClose (this=0x8b90b0) at ../../Source/WebCore/dom/Document.cpp:2438 #21 0x00007ffff399e745 in WebCore::FrameLoader::checkCallImplicitClose (this=0x9fc4e8) at ../../Source/WebCore/loader/FrameLoader.cpp:898 #22 0x00007ffff399e4f0 in WebCore::FrameLoader::checkCompleted (this=0x9fc4e8) at ../../Source/WebCore/loader/FrameLoader.cpp:844 ---Type <return> to continue, or q <return> to quit--- #23 0x00007ffff399e278 in WebCore::FrameLoader::finishedParsing (this=0x9fc4e8) at ../../Source/WebCore/loader/FrameLoader.cpp:764 #24 0x00007ffff35470db in WebCore::Document::finishedParsing (this=0x8b90b0) at ../../Source/WebCore/dom/Document.cpp:4519 #25 0x00007ffff383a805 in WebCore::HTMLConstructionSite::finishedParsing (this=0xa0a098) at ../../Source/WebCore/html/parser/HTMLConstructionSite.cpp:395 #26 0x00007ffff3874c57 in WebCore::HTMLTreeBuilder::finished (this=0xa0a080) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2997 #27 0x00007ffff38423a0 in WebCore::HTMLDocumentParser::end (this=0x915730) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:451 #28 0x00007ffff384248b in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd (this=0x915730) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:462 #29 0x00007ffff3840ff9 in WebCore::HTMLDocumentParser::prepareToStopParsing (this=0x915730) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:165 #30 0x00007ffff38424ce in WebCore::HTMLDocumentParser::attemptToEnd (this=0x915730) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:474 #31 0x00007ffff3842585 in WebCore::HTMLDocumentParser::finish (this=0x915730) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:502 #32 0x00007ffff3991445 in WebCore::DocumentWriter::end (this=0x850a80) at ../../Source/WebCore/loader/DocumentWriter.cpp:250 #33 0x00007ffff397e49b in WebCore::DocumentLoader::finishedLoading (this=0x8509e0, finishTime=0) at ../../Source/WebCore/loader/DocumentLoader.cpp:441 #34 0x00007ffff397e204 in WebCore::DocumentLoader::notifyFinished (this=0x8509e0, resource=0x88b970) at ../../Source/WebCore/loader/DocumentLoader.cpp:375 #35 0x00007ffff3a24a99 in WebCore::CachedResource::checkNotify (this=0x88b970) at ../../Source/WebCore/loader/cache/CachedResource.cpp:334 #36 0x00007ffff3a24b80 in WebCore::CachedResource::finishLoading (this=0x88b970) at ../../Source/WebCore/loader/cache/CachedResource.cpp:350 #37 0x00007ffff3a21b3a in WebCore::CachedRawResource::finishLoading (this=0x88b970, data=0x9e7c00) at ../../Source/WebCore/loader/cache/CachedRawResource.cpp:98 #38 0x00007ffff39d87da in WebCore::SubresourceLoader::didFinishLoading (this=0x914710, finishTime=0) at ../../Source/WebCore/loader/SubresourceLoader.cpp:310 #39 0x00007ffff39d4cc7 in WebCore::ResourceLoader::didFinishLoading (this=0x914710, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:517 #40 0x00007ffff4297429 in WebCore::readCallback (asyncResult=0x9e81d0, data=0x914ec0) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1302 #41 0x00007fffec1d82ea in async_ready_callback_wrapper (source_object=0x98cb30, res=0x9e81d0, user_data=0x914ec0) at ginputstream.c:519 #42 0x00007fffec1f7ceb in g_task_return_now (task=0x9e81d0) at gtask.c:1108 #43 0x00007fffec1f7d09 in complete_in_idle_cb (task=0x9e81d0) at gtask.c:1117 #44 0x00007fffeb44e2e6 in g_main_dispatch (context=0x677bc0) at gmain.c:3065 #45 g_main_context_dispatch (context=context@entry=0x677bc0) at gmain.c:3641 #46 0x00007fffeb44e638 in g_main_context_iterate (context=0x677bc0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3712 ---Type <return> to continue, or q <return> to quit--- #47 0x00007fffeb44ea3a in g_main_loop_run (loop=0x6f0010) at gmain.c:3906 #48 0x00007ffff306a156 in WTF::RunLoop::run () at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:59 #49 0x00007ffff2fa35e0 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffd948) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61 #50 0x00007ffff2fa3445 in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffd948) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:73 #51 0x000000000040085d in main (argc=2, argv=0x7fffffffd948) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:32
Created attachment 264926 [details] Test Replacing the original test case since it doesn't reproduce the issue anymore.
This issue no longer occurs under GuardMalloc or ASAN as of r204037. If you believe there is still a bug, please reopen this issue with a revised test case.