Bug 139045 - ASSERTION FAILED: multiColumnFlowThread()->findColumnSpannerPlaceholder(next) in WebCore::RenderMultiColumnSet::requiresBalancing
Summary: ASSERTION FAILED: multiColumnFlowThread()->findColumnSpannerPlaceholder(next)...
Status: RESOLVED WORKSFORME
Alias: None
Product: WebKit
Classification: Unclassified
Component: Tables (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks: 116980
  Show dependency treegraph
 
Reported: 2014-11-25 08:54 PST by Renata Hodovan
Modified: 2016-08-04 10:23 PDT (History)
2 users (show)

See Also:


Attachments
Test case (193 bytes, text/html)
2014-11-25 08:54 PST, Renata Hodovan
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Renata Hodovan 2014-11-25 08:54:56 PST
Created attachment 242198 [details]
Test case

Load the following test with debug WebKit (supplying the doctype would solve the issue):

<style>
* {
    column-span:all;
    -webkit-columns:1095pc;
    opacity:inherit;
    display:compact;
    -webkit-perspective:9429vmin;
}
</style>
<table align="left">
    <col></col>
</table>



Backtrace:

ASSERTION FAILED: multiColumnFlowThread()->findColumnSpannerPlaceholder(next)
../../Source/WebCore/rendering/RenderMultiColumnSet.cpp(320) : bool WebCore::RenderMultiColumnSet::requiresBalancing() const

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fff98c4e700 (LWP 4246)]
0x00007fffedc7ea89 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321
321	    *(int *)(uintptr_t)0xbbadbeef = 0;
#0  0x00007fffedc7ea89 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321
#1  0x00007ffff3b1b2ae in WebCore::RenderMultiColumnSet::requiresBalancing (this=0x8c2360) at ../../Source/WebCore/rendering/RenderMultiColumnSet.cpp:320
#2  0x00007ffff3b1b3cf in WebCore::RenderMultiColumnSet::prepareForLayout (this=0x8c2360, initial=true) at ../../Source/WebCore/rendering/RenderMultiColumnSet.cpp:340
#3  0x00007ffff39e3f3c in WebCore::RenderBlockFlow::layoutSpecialExcludedChild (this=0x7170e0, relayoutChildren=false) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:3677
#4  0x00007ffff39d4ed4 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x7170e0, relayoutChildren=false, maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:592
#5  0x00007ffff39d4438 in WebCore::RenderBlockFlow::layoutBlock (this=0x7170e0, relayoutChildren=false, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:473
#6  0x00007ffff39aa07f in WebCore::RenderBlock::layout (this=0x7170e0) at ../../Source/WebCore/rendering/RenderBlock.cpp:931
#7  0x00007ffff39d54ee in WebCore::RenderBlockFlow::layoutBlockChild (this=0x610960, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:699
#8  0x00007ffff39d500b in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x610960, relayoutChildren=false, maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:620
#9  0x00007ffff39d4438 in WebCore::RenderBlockFlow::layoutBlock (this=0x610960, relayoutChildren=false, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:473
#10 0x00007ffff39aa07f in WebCore::RenderBlock::layout (this=0x610960) at ../../Source/WebCore/rendering/RenderBlock.cpp:931
#11 0x00007ffff39d54ee in WebCore::RenderBlockFlow::layoutBlockChild (this=0x65dc00, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:699
#12 0x00007ffff39d500b in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x65dc00, relayoutChildren=false, maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:620
#13 0x00007ffff39d4438 in WebCore::RenderBlockFlow::layoutBlock (this=0x65dc00, relayoutChildren=false, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:473
#14 0x00007ffff39aa07f in WebCore::RenderBlock::layout (this=0x65dc00) at ../../Source/WebCore/rendering/RenderBlock.cpp:931
#15 0x00007ffff3b9f89b in WebCore::RenderView::layoutContent (this=0x65dc00, state=...) at ../../Source/WebCore/rendering/RenderView.cpp:232
#16 0x00007ffff3b9ff6b in WebCore::RenderView::layout (this=0x65dc00) at ../../Source/WebCore/rendering/RenderView.cpp:357
#17 0x00007ffff3711889 in WebCore::FrameView::layout (this=0x64c740, allowSubtree=true) at ../../Source/WebCore/page/FrameView.cpp:1313
#18 0x00007ffff371acbb in WebCore::FrameView::updateLayoutAndStyleIfNeededRecursive (this=0x64c740) at ../../Source/WebCore/page/FrameView.cpp:3935
#19 0x00007ffff2ab53cc in WebKit::WebPage::layoutIfNeeded (this=0x5c92e0) at ../../Source/WebKit2/WebProcess/WebPage/WebPage.cpp:1220
#20 0x00007ffff2ba8f22 in WebKit::DrawingAreaImpl::display (this=0x65d740, updateInfo=...) at ../../Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp:589
#21 0x00007ffff2ba8c0e in WebKit::DrawingAreaImpl::display (this=0x65d740) at ../../Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp:550
#22 0x00007ffff2ba8acc in WebKit::DrawingAreaImpl::displayTimerFired (this=0x65d740) at ../../Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp:529
#23 0x00007ffff2baaf8b in WTF::RunLoop::Timer<WebKit::DrawingAreaImpl>::fired (this=0x65d938) at ../../Source/WTF/wtf/RunLoop.h:121
#24 0x00007ffff464b93b in WTF::RunLoop::TimerBase::__lambda1::operator() (__closure=0x600660) at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:121
#25 0x00007ffff464bde1 in std::_Function_handler<bool(), WTF::RunLoop::TimerBase::start(double, bool)::__lambda1>::_M_invoke(const std::_Any_data &) (__functor=...) at /usr/include/c++/4.8/functional:2057
#26 0x00007ffff464afc2 in std::function<bool ()>::operator()() const (this=0x7fffffffd5c8) at /usr/include/c++/4.8/functional:2464
#27 0x00007fffedcc861c in WTF::GMainLoopSource::boolCallback (this=0x65d948) at ../../Source/WTF/wtf/gobject/GMainLoopSource.cpp:405
#28 0x00007fffedcc8a91 in WTF::GMainLoopSource::boolSourceCallback (source=0x65d948, source@entry=<error reading variable: value has been optimized out>) at ../../Source/WTF/wtf/gobject/GMainLoopSource.cpp:462
#29 0x00007fffeaaff453 in g_timeout_dispatch (source=0x58c680, callback=<optimized out>, user_data=<optimized out>) at gmain.c:4472
#30 0x00007fffeaafea2d in g_main_dispatch (context=0x478020) at gmain.c:3064
#31 g_main_context_dispatch (context=context@entry=0x478020) at gmain.c:3663
#32 0x00007fffeaafed98 in g_main_context_iterate (context=0x478020, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3734
#33 0x00007fffeaaff05a in g_main_loop_run (loop=0x9015f0) at gmain.c:3928
#34 0x00007ffff464b42e in WTF::RunLoop::run () at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:59
#35 0x00007ffff2bb8250 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffd968) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61
#36 0x00007ffff2bb80b5 in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffd968) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:73
#37 0x0000000000400891 in main (argc=2, argv=0x7fffffffd968) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:44
Comment 1 Brent Fulgham 2016-08-04 10:23:13 PDT
This issue no longer happens in r204037 under GuardMalloc or ASAN. If you believe there is still an issue, please reopen this bug with a revised test case.