136365 – ASSERTION FAILED: count >= 1 in WebCore::RenderMultiColumnSet::columnCount

RESOLVED FIXED Bug 136365

ASSERTION FAILED: count >= 1 in WebCore::RenderMultiColumnSet::columnCount

https://bugs.webkit.org/show_bug.cgi?id=136365

Summary ASSERTION FAILED: count >= 1 in WebCore::RenderMultiColumnSet::columnCount

Renata Hodovan

Reported 2014-08-29 04:54:09 PDT

Created attachment 237343 [details] Test case The failing test case: <!DOCTYPE html> <CITE> <object></object> </CITE> <style> * { padding-right: 3%; -webkit-column-count: 2; padding-top: 17902000vh; } </style> Backtrace: ASSERTION FAILED: count >= 1 /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderMultiColumnSet.cpp(443) : unsigned int WebCore::RenderMultiColumnSet::columnCount() const 1 0x7ffff3ef343b WTFCrash 2 0x7ffff3037e76 WebCore::RenderMultiColumnSet::columnCount() const 3 0x7ffff303a580 WebCore::RenderMultiColumnSet::addOverflowFromChildren() 4 0x7ffff2ed2a79 WebCore::RenderBlock::computeOverflow(WebCore::LayoutUnit, bool) 5 0x7ffff2f06e6b WebCore::RenderBlockFlow::computeOverflow(WebCore::LayoutUnit, bool) 6 0x7ffff2effb85 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 7 0x7ffff2ed25af WebCore::RenderBlock::layout() 8 0x7ffff3037b17 WebCore::RenderMultiColumnSet::layout() 9 0x7ffff2f00790 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 10 0x7ffff2f002b1 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 11 0x7ffff2eff6ce WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 12 0x7ffff2f0e46b WebCore::RenderBlockFlow::relayoutForPagination(WebCore::LayoutStateMaintainer&) 13 0x7ffff2eff816 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 14 0x7ffff2ed25af WebCore::RenderBlock::layout() 15 0x7ffff2f00790 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 16 0x7ffff2f002b1 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 17 0x7ffff2eff6ce WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 18 0x7ffff2ed25af WebCore::RenderBlock::layout() 19 0x7ffff2f8d874 WebCore::RenderFlowThread::layout() 20 0x7ffff303113c WebCore::RenderMultiColumnFlowThread::layout() 21 0x7ffff2f0eb86 WebCore::RenderBlockFlow::layoutSpecialExcludedChild(bool) 22 0x7ffff2f0017a WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 23 0x7ffff2eff6ce WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 24 0x7ffff2ed25af WebCore::RenderBlock::layout() 25 0x7ffff2f00790 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 26 0x7ffff2f002b1 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 27 0x7ffff2eff6ce WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 28 0x7ffff2ed25af WebCore::RenderBlock::layout() 29 0x7ffff30bd207 WebCore::RenderView::layoutContent(WebCore::LayoutState const&) 30 0x7ffff30bd8d7 WebCore::RenderView::layout() 31 0x7ffff2cfd2e5 WebCore::FrameView::layout(bool) Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fff91255700 (LWP 17731)] 0x00007ffff3ef3440 in WTFCrash () at /home/reni/data/REPOS/webkit/Source/WTF/wtf/Assertions.cpp:329 329 *(int *)(uintptr_t)0xbbadbeef = 0; #0 0x00007ffff3ef3440 in WTFCrash () at /home/reni/data/REPOS/webkit/Source/WTF/wtf/Assertions.cpp:329 #1 0x00007ffff3037e76 in WebCore::RenderMultiColumnSet::columnCount (this=0x7ff210) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderMultiColumnSet.cpp:443 #2 0x00007ffff303a580 in WebCore::RenderMultiColumnSet::addOverflowFromChildren (this=0x7ff210) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderMultiColumnSet.cpp:868 #3 0x00007ffff2ed2a79 in WebCore::RenderBlock::computeOverflow (this=0x7ff210, oldClientAfterEdge=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlock.cpp:1102 #4 0x00007ffff2f06e6b in WebCore::RenderBlockFlow::computeOverflow (this=0x7ff210, oldClientAfterEdge=..., recomputeFloats=false) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:2080 #5 0x00007ffff2effb85 in WebCore::RenderBlockFlow::layoutBlock (this=0x7ff210, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:527 #6 0x00007ffff2ed25af in WebCore::RenderBlock::layout (this=0x7ff210) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlock.cpp:1019 #7 0x00007ffff3037b17 in WebCore::RenderMultiColumnSet::layout (this=0x7ff210) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderMultiColumnSet.cpp:388 #8 0x00007ffff2f00790 in WebCore::RenderBlockFlow::layoutBlockChild (this=0x7118d0, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:711 #9 0x00007ffff2f002b1 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x7118d0, relayoutChildren=true, maxFloatLogicalBottom=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:632 #10 0x00007ffff2eff6ce in WebCore::RenderBlockFlow::layoutBlock (this=0x7118d0, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:485 #11 0x00007ffff2f0e46b in WebCore::RenderBlockFlow::relayoutForPagination (this=0x7118d0, statePusher=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:3390 #12 0x00007ffff2eff816 in WebCore::RenderBlockFlow::layoutBlock (this=0x7118d0, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:492 #13 0x00007ffff2ed25af in WebCore::RenderBlock::layout (this=0x7118d0) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlock.cpp:1019 #14 0x00007ffff2f00790 in WebCore::RenderBlockFlow::layoutBlockChild (this=0x7b03a0, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:711 #15 0x00007ffff2f002b1 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x7b03a0, relayoutChildren=false, maxFloatLogicalBottom=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:632 #16 0x00007ffff2eff6ce in WebCore::RenderBlockFlow::layoutBlock (this=0x7b03a0, relayoutChildren=false, pageLogicalHeight=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:485 #17 0x00007ffff2ed25af in WebCore::RenderBlock::layout (this=0x7b03a0) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlock.cpp:1019 #18 0x00007ffff2f8d874 in WebCore::RenderFlowThread::layout (this=0x7b03a0) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderFlowThread.cpp:201 #19 0x00007ffff303113c in WebCore::RenderMultiColumnFlowThread::layout (this=0x7b03a0) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp:135 #20 0x00007ffff2f0eb86 in WebCore::RenderBlockFlow::layoutSpecialExcludedChild (this=0x6e2bd0, relayoutChildren=true) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:3627 #21 0x00007ffff2f0017a in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x6e2bd0, relayoutChildren=true, maxFloatLogicalBottom=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:604 #22 0x00007ffff2eff6ce in WebCore::RenderBlockFlow::layoutBlock (this=0x6e2bd0, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:485 #23 0x00007ffff2ed25af in WebCore::RenderBlock::layout (this=0x6e2bd0) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlock.cpp:1019 #24 0x00007ffff2f00790 in WebCore::RenderBlockFlow::layoutBlockChild (this=0x73b3a0, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:711 #25 0x00007ffff2f002b1 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x73b3a0, relayoutChildren=true, maxFloatLogicalBottom=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:632 #26 0x00007ffff2eff6ce in WebCore::RenderBlockFlow::layoutBlock (this=0x73b3a0, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlockFlow.cpp:485 #27 0x00007ffff2ed25af in WebCore::RenderBlock::layout (this=0x73b3a0) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderBlock.cpp:1019 #28 0x00007ffff30bd207 in WebCore::RenderView::layoutContent (this=0x73b3a0, state=...) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderView.cpp:232 #29 0x00007ffff30bd8d7 in WebCore::RenderView::layout (this=0x73b3a0) at /home/reni/data/REPOS/webkit/Source/WebCore/rendering/RenderView.cpp:357 #30 0x00007ffff2cfd2e5 in WebCore::FrameView::layout (this=0x6e0a80, allowSubtree=true) at /home/reni/data/REPOS/webkit/Source/WebCore/page/FrameView.cpp:1301 #31 0x00007ffff27e806b in WebCore::Document::implicitClose (this=0x70f290) at /home/reni/data/REPOS/webkit/Source/WebCore/dom/Document.cpp:2440 #32 0x00007ffff2bc4749 in WebCore::FrameLoader::checkCallImplicitClose (this=0x6cfdf8) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/FrameLoader.cpp:898 #33 0x00007ffff2bc44b1 in WebCore::FrameLoader::checkCompleted (this=0x6cfdf8) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/FrameLoader.cpp:844 #34 0x00007ffff2bc421a in WebCore::FrameLoader::finishedParsing (this=0x6cfdf8) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/FrameLoader.cpp:764 #35 0x00007ffff27f0aed in WebCore::Document::finishedParsing (this=0x70f290) at /home/reni/data/REPOS/webkit/Source/WebCore/dom/Document.cpp:4523 #36 0x00007ffff39011b9 in WebCore::HTMLConstructionSite::finishedParsing (this=0x781398) at /home/reni/data/REPOS/webkit/Source/WebCore/html/parser/HTMLConstructionSite.cpp:395 #37 0x00007ffff2adf389 in WebCore::HTMLTreeBuilder::finished (this=0x781380) at /home/reni/data/REPOS/webkit/Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2997 #38 0x00007ffff2ab1028 in WebCore::HTMLDocumentParser::end (this=0x6b9500) at /home/reni/data/REPOS/webkit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:451 #39 0x00007ffff2ab1113 in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd (this=0x6b9500) at /home/reni/data/REPOS/webkit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:462 #40 0x00007ffff2aafac9 in WebCore::HTMLDocumentParser::prepareToStopParsing (this=0x6b9500) at /home/reni/data/REPOS/webkit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:165 #41 0x00007ffff2ab1156 in WebCore::HTMLDocumentParser::attemptToEnd (this=0x6b9500) at /home/reni/data/REPOS/webkit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:474 #42 0x00007ffff2ab120d in WebCore::HTMLDocumentParser::finish (this=0x6b9500) at /home/reni/data/REPOS/webkit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:502 #43 0x00007ffff2bb5911 in WebCore::DocumentWriter::end (this=0x783e60) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/DocumentWriter.cpp:250 #44 0x00007ffff2ba0ea7 in WebCore::DocumentLoader::finishedLoading (this=0x783dc0, finishTime=0) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/DocumentLoader.cpp:441 #45 0x00007ffff2ba0c10 in WebCore::DocumentLoader::notifyFinished (this=0x783dc0, resource=0x79eb80) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/DocumentLoader.cpp:375 #46 0x00007ffff2c54952 in WebCore::CachedResource::checkNotify (this=0x79eb80) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/cache/CachedResource.cpp:333 #47 0x00007ffff2c54a5c in WebCore::CachedResource::finishLoading (this=0x79eb80) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/cache/CachedResource.cpp:349 #48 0x00007ffff2c5138a in WebCore::CachedRawResource::finishLoading (this=0x79eb80, data=0x6c2e10) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/cache/CachedRawResource.cpp:101 #49 0x00007ffff2c0452c in WebCore::SubresourceLoader::didFinishLoading (this=0x79f0e0, finishTime=0) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/SubresourceLoader.cpp:306 #50 0x00007ffff2c001bb in WebCore::ResourceLoader::didFinishLoading (this=0x79f0e0, finishTime=0) at /home/reni/data/REPOS/webkit/Source/WebCore/loader/ResourceLoader.cpp:512 #51 0x00007ffff339390d in WebCore::readCallback (asyncResult=0x7a29f0, data=0x79f710) at /home/reni/data/REPOS/webkit/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1302 #52 0x00007fffeb3c1816 in async_ready_callback_wrapper (source_object=0x6c4db0, res=0x7a29f0, user_data=user_data@entry=0x79f710) at ginputstream.c:523 #53 0x00007fffeb3e7115 in g_task_return_now (task=0x7a29f0) at gtask.c:1077 #54 0x00007fffeb3e7139 in complete_in_idle_cb (task=0x7a29f0) at gtask.c:1086 #55 0x00007fffeae23a7d in g_main_dispatch (context=0x6bc390) at gmain.c:3064 #56 g_main_context_dispatch (context=context@entry=0x6bc390) at gmain.c:3663 #57 0x00007fffec6875e0 in _ecore_glib_select__locked (ecore_timeout=<optimized out>, efds=<optimized out>, wfds=0x7fffffffd5d0, rfds=0x7fffffffd550, ecore_fds=10, ctx=<optimized out>) at lib/ecore/ecore_glib.c:172 #58 _ecore_glib_select (ecore_fds=10, rfds=0x7fffffffd550, wfds=0x7fffffffd5d0, efds=<optimized out>, ecore_timeout=<optimized out>) at lib/ecore/ecore_glib.c:204 #59 0x00007fffec689ff4 in _ecore_main_select (timeout=<optimized out>) at lib/ecore/ecore_main.c:1579 #60 0x00007fffec68a995 in _ecore_main_loop_iterate_internal (once_only=once_only@entry=0) at lib/ecore/ecore_main.c:2005 #61 0x00007fffec68aa57 in ecore_main_loop_begin () at lib/ecore/ecore_main.c:1042 #62 0x00007ffff3f38db5 in WTF::RunLoop::run () at /home/reni/data/REPOS/webkit/Source/WTF/wtf/efl/RunLoopEfl.cpp:51 #63 0x00007ffff207062a in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffda78) at /home/reni/data/REPOS/webkit/Source/WebKit2/Shared/unix/ChildProcessMain.h:61 #64 0x00007ffff2070408 in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffda78) at /home/reni/data/REPOS/webkit/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp:124 #65 0x000000000040084d in main (argc=2, argv=0x7fffffffda78) at /home/reni/data/REPOS/webkit/Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:32

Attachments
Test case (150 bytes, text/html) 2014-08-29 04:54 PDT, Renata Hodovan	no flags	Details
Repro 2 (68 bytes, text/html) 2015-02-10 07:55 PST, Renata Hodovan	no flags	Details
Patch (3.49 KB, patch) 2016-12-07 14:14 PST, zalan	no flags	Details Formatted Diff Diff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.

Renata Hodovan

Comment 1 2015-01-29 06:37:32 PST

I can't repro this anymore.

Renata Hodovan

Comment 2 2015-02-10 07:55:45 PST

Created attachment 246325 [details] Repro 2 Reopening the bug since the new test case still produces the failure.

Renata Hodovan

Comment 3 2015-02-10 07:56:55 PST

Reopening...

Brent Fulgham

Comment 4 2016-08-03 14:58:46 PDT

This reproduces in r204037.

Radar WebKit Bug Importer

Comment 5 2016-08-03 15:03:40 PDT

<rdar://problem/27686727>

zalan

Comment 6 2016-12-07 14:14:58 PST

Created attachment 296421 [details] Patch

WebKit Commit Bot

Comment 7 2016-12-07 15:21:56 PST

Comment on attachment 296421 [details] Patch Clearing flags on attachment: 296421 Committed r209487: <http://trac.webkit.org/changeset/209487>

WebKit Commit Bot

Comment 8 2016-12-07 15:22:01 PST

All reviewed patches have been landed. Closing bug.

Note You need to log in before you can comment on or make changes to this bug.

Status RESOLVED

Resolution FIXED

Priority P2

Severity Normal

Classification Unclassified

Version 528+ (Nightly build)

Hardware Unspecified

OS Unspecified

Product WebKit

Component Layout and Rendering

Assignee

zalan

Reported

2014-08-29 04:54 PDT

Modified

2016-12-07 15:22 PST History

CC List

7 users Show

URL

Keywords InRadar

Depends on

Blocks

116980

Dependancies

tree graph