Descendant is being put into the wrong flow thread with nested columns and spans. See the FIXME in isValidColumnSpanner in RenderMultiColumnFlowThread.cpp.
Created attachment 240986 [details] Patch
Comment on attachment 240986 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=240986&action=review > Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp:387 > + placeholder.parent()->removeChild(placeholder); I think you want a "// FIXME: placeholder is leaked" here.
Comment on attachment 240986 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=240986&action=review > Source/WebCore/ChangeLog:20 > + The second fix was to stop destroying the placeholder. Since the placeholder can just have been inserted, you > + can't delete it, since otherwise code further up the stack will access the deleted object. For now, we just > + leak the placeholder. Would using a RenderPtr<> for the placeholder (née descendant) fix the leak/object lifetime? >> Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp:387 >> - ancestorBlock.multiColumnFlowThread()->handleSpannerRemoval(spanner); >> - placeholder.destroy(); >> - >> + if (subtreeRoot == descendant) >> + subtreeRoot = spanner; >> + placeholder.parent()->removeChild(placeholder); > > I think you want a "// FIXME: placeholder is leaked" here. And a new bug number that tracks the leak please.
Fixed in r175641.
<rdar://problem/18885189>
*** Bug 137316 has been marked as a duplicate of this bug. ***