Bug 151086 – ASSERTION FAILED: !sibling->isRenderMultiColumnSet() in WebCore::RenderMultiColumnSet::lastRendererInFlowThread

• Status: RESOLVED
• Resolution: WORKSFORME
• Component: Layout and Rendering

[Renata Hodovan]

Created attachment 265160 [details]
Test

Load the attached test with debug MiniBrowser:

<style>
* {
    -webkit-animation-delay:-1476.3ms;
    animation-name:animation_0;
    display:table-caption;
    -webkit-columns:7740;
    column-span:all
}
</style>
<embed type="A">
    <mark>
        <video></video>
    </mark>
</embed>


OS: Ubuntu 15.04 x86_64
Checked build: debug EFL
Checked version: 29ae33c


Backtrace:

ASSERTION FAILED: !sibling->isRenderMultiColumnSet()
../../Source/WebCore/rendering/RenderMultiColumnSet.cpp(87) : WebCore::RenderObject* WebCore::RenderMultiColumnSet::lastRendererInFlowThread() const
1   0x7f909616289f WTFCrash
2   0x7f909cbdd520 WebCore::RenderMultiColumnSet::lastRendererInFlowThread() const
3   0x7f909cbdd625 WebCore::RenderMultiColumnSet::containsRendererInFlowThread(WebCore::RenderObject*) const
4   0x7f909cbd761f WebCore::RenderMultiColumnFlowThread::findSetRendering(WebCore::RenderObject*) const
5   0x7f909cbd7f93 WebCore::RenderMultiColumnFlowThread::processPossibleSpannerDescendant(WebCore::RenderObject*&, WebCore::RenderObject*)
6   0x7f909cbd8586 WebCore::RenderMultiColumnFlowThread::flowThreadDescendantInserted(WebCore::RenderObject*)
7   0x7f909cbfaa33 WebCore::RenderObject::insertedIntoTree()
8   0x7f909cb04b63 WebCore::RenderElement::insertedIntoTree()
9   0x7f909cb02f6f WebCore::RenderElement::insertChildInternal(WebCore::RenderObject*, WebCore::RenderObject*, WebCore::RenderElement::NotifyChildrenType)
10  0x7f909cb02af2 WebCore::RenderElement::addChild(WebCore::RenderObject*, WebCore::RenderObject*)
11  0x7f909ca54a24 WebCore::RenderBlock::addChildIgnoringContinuation(WebCore::RenderObject*, WebCore::RenderObject*)
12  0x7f909ca544fa WebCore::RenderBlock::addChild(WebCore::RenderObject*, WebCore::RenderObject*)
13  0x7f909ca944df WebCore::RenderBlockFlow::addChild(WebCore::RenderObject*, WebCore::RenderObject*)
14  0x7f909ca94484 WebCore::RenderBlockFlow::addChild(WebCore::RenderObject*, WebCore::RenderObject*)
15  0x7f909cd35692 WebCore::RenderTreePosition::insert(WebCore::RenderObject&)
16  0x7f909cd31a18
17  0x7f909cd32ce4
18  0x7f909cd33728
19  0x7f909cd34304
20  0x7f909cd33ff1
21  0x7f909cd343f7
22  0x7f909cd33ff1
23  0x7f909cd343f7
24  0x7f909cd346c6 WebCore::Style::resolveTree(WebCore::Document&, WebCore::Style::Change)
25  0x7f909c295d4c WebCore::Document::recalcStyle(WebCore::Style::Change)
26  0x7f909c29608d WebCore::Document::updateStyleIfNeeded()
27  0x7f909c8acd86 WebCore::AnimationControllerPrivate::updateAnimations(WebCore::SetChanged)
28  0x7f909c8ad62f WebCore::AnimationControllerPrivate::animationFrameCallbackFired()
29  0x7f909c8af38c WebCore::AnimationController::serviceAnimations()
30  0x7f909c8406e0 WebCore::FrameView::serviceScriptedAnimations(double)
31  0x7f909ceee5e4 WebCore::CompositingCoordinator::syncDisplayState()
Aborted (core dumped)

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f90961628a4 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321
321     *(int *)(uintptr_t)0xbbadbeef = 0;
#0  0x00007f90961628a4 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321
#1  0x00007f909cbdd520 in WebCore::RenderMultiColumnSet::lastRendererInFlowThread (this=0x7f907d6eadc0) at ../../Source/WebCore/rendering/RenderMultiColumnSet.cpp:87
#2  0x00007f909cbdd625 in WebCore::RenderMultiColumnSet::containsRendererInFlowThread (this=0x7f907d6eadc0, renderer=0x7f907d771cb0) at ../../Source/WebCore/rendering/RenderMultiColumnSet.cpp:111
#3  0x00007f909cbd761f in WebCore::RenderMultiColumnFlowThread::findSetRendering (this=0x7f907d6a3b18, renderer=0x7f907d771cb0) at ../../Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp:139
#4  0x00007f909cbd7f93 in WebCore::RenderMultiColumnFlowThread::processPossibleSpannerDescendant (this=0x7f907d6a3b18, subtreeRoot=@0x7ffd45f7c618: 0x7f907d771cb0, descendant=0x7f907d771cb0) at ../../Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp:289
#5  0x00007f909cbd8586 in WebCore::RenderMultiColumnFlowThread::flowThreadDescendantInserted (this=0x7f907d6a3b18, descendant=0x7f907d771cb0) at ../../Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp:395
#6  0x00007f909cbfaa33 in WebCore::RenderObject::insertedIntoTree (this=0x7f907d771cb0) at ../../Source/WebCore/rendering/RenderObject.cpp:1554
#7  0x00007f909cb04b63 in WebCore::RenderElement::insertedIntoTree (this=0x7f907d771cb0) at ../../Source/WebCore/rendering/RenderElement.cpp:1057
#8  0x00007f909cb02f6f in WebCore::RenderElement::insertChildInternal (this=0x7f907d6a3b18, newChild=0x7f907d771cb0, beforeChild=0x7f907d6a9290, notifyChildren=WebCore::RenderElement::NotifyChildren) at ../../Source/WebCore/rendering/RenderElement.cpp:602
#9  0x00007f909cb02af2 in WebCore::RenderElement::addChild (this=0x7f907d6a3b18, newChild=0x7f907d771cb0, beforeChild=0x7f907d6a9290) at ../../Source/WebCore/rendering/RenderElement.cpp:526
#10 0x00007f909ca54a24 in WebCore::RenderBlock::addChildIgnoringContinuation (this=0x7f907d6a3b18, newChild=0x7f907d771cb0, beforeChild=0x7f907d6a9290) at ../../Source/WebCore/rendering/RenderBlock.cpp:492
#11 0x00007f909ca544fa in WebCore::RenderBlock::addChild (this=0x7f907d6a3b18, newChild=0x7f907d771cb0, beforeChild=0x7f907d7b75c0) at ../../Source/WebCore/rendering/RenderBlock.cpp:407
#12 0x00007f909ca944df in WebCore::RenderBlockFlow::addChild (this=0x7f907d6a3b18, newChild=0x7f907d771cb0, beforeChild=0x7f907d7b75c0) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:3796
#13 0x00007f909ca94484 in WebCore::RenderBlockFlow::addChild (this=0x7f907d7b7508, newChild=0x7f907d771cb0, beforeChild=0x7f907d7b75c0) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:3791
#14 0x00007f909cd35692 in WebCore::RenderTreePosition::insert (this=0x7ffd45f7c940, renderer=...) at ../../Source/WebCore/style/RenderTreePosition.h:92
#15 0x00007f909cd31a18 in WebCore::Style::createRendererIfNeeded (element=..., inheritedStyle=..., renderTreePosition=..., resolvedStyle=...) at ../../Source/WebCore/style/StyleResolveTree.cpp:220
#16 0x00007f909cd32ce4 in WebCore::Style::attachRenderTree (current=..., inheritedStyle=..., renderTreePosition=..., resolvedStyle=...) at ../../Source/WebCore/style/StyleResolveTree.cpp:480
#17 0x00007f909cd33728 in WebCore::Style::resolveLocal (current=..., inheritedStyle=..., renderTreePosition=..., inheritedChange=WebCore::Style::Force) at ../../Source/WebCore/style/StyleResolveTree.cpp:629
#18 0x00007f909cd34304 in WebCore::Style::resolveTree (current=..., inheritedStyle=..., renderTreePosition=..., change=WebCore::Style::Force) at ../../Source/WebCore/style/StyleResolveTree.cpp:850
#19 0x00007f909cd33ff1 in WebCore::Style::resolveChildren (current=..., inheritedStyle=..., change=WebCore::Style::Force, childRenderTreePosition=...) at ../../Source/WebCore/style/StyleResolveTree.cpp:798
#20 0x00007f909cd343f7 in WebCore::Style::resolveTree (current=..., inheritedStyle=..., renderTreePosition=..., change=WebCore::Style::Force) at ../../Source/WebCore/style/StyleResolveTree.cpp:864
#21 0x00007f909cd33ff1 in WebCore::Style::resolveChildren (current=..., inheritedStyle=..., change=WebCore::Style::Force, childRenderTreePosition=...) at ../../Source/WebCore/style/StyleResolveTree.cpp:798
#22 0x00007f909cd343f7 in WebCore::Style::resolveTree (current=..., inheritedStyle=..., renderTreePosition=..., change=WebCore::Style::Force) at ../../Source/WebCore/style/StyleResolveTree.cpp:864
#23 0x00007f909cd346c6 in WebCore::Style::resolveTree (document=..., change=WebCore::Style::NoChange) at ../../Source/WebCore/style/StyleResolveTree.cpp:910
#24 0x00007f909c295d4c in WebCore::Document::recalcStyle (this=0x7f907d426a40, change=WebCore::Style::NoChange) at ../../Source/WebCore/dom/Document.cpp:1841
#25 0x00007f909c29608d in WebCore::Document::updateStyleIfNeeded (this=0x7f907d426a40) at ../../Source/WebCore/dom/Document.cpp:1892
#26 0x00007f909c8acd86 in WebCore::AnimationControllerPrivate::updateAnimations (this=0x7f907d6e2160, callSetChanged=WebCore::CallSetChanged) at ../../Source/WebCore/page/animation/AnimationController.cpp:148
#27 0x00007f909c8ad62f in WebCore::AnimationControllerPrivate::animationFrameCallbackFired (this=0x7f907d6e2160) at ../../Source/WebCore/page/animation/AnimationController.cpp:250
#28 0x00007f909c8af38c in WebCore::AnimationController::serviceAnimations (this=0x7f907d7fa048) at ../../Source/WebCore/page/animation/AnimationController.cpp:717
#29 0x00007f909c8406e0 in WebCore::FrameView::serviceScriptedAnimations (this=0x7f907d425540, monotonicAnimationStartTime=952777.62572080805) at ../../Source/WebCore/page/FrameView.cpp:2750
#30 0x00007f909ceee5e4 in WebCore::CompositingCoordinator::syncDisplayState (this=0x7f907d6e0000) at ../../Source/WebCore/platform/graphics/texmap/coordinated/CompositingCoordinator.cpp:128
#31 0x00007f909c0185fa in WebKit::CoordinatedLayerTreeHost::performScheduledLayerFlush (this=0x7f907d7e2210) at ../../Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedLayerTreeHost.cpp:207
#32 0x00007f909c0186de in WebKit::CoordinatedLayerTreeHost::layerFlushTimerFired (this=0x7f907d7e2210) at ../../Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedLayerTreeHost.cpp:227
#33 0x00007f909c019f27 in std::_Mem_fn<void (WebKit::CoordinatedLayerTreeHost::*)()>::operator()<, void>(WebKit::CoordinatedLayerTreeHost*) const (this=0x1c338a0, __object=0x7f907d7e2210) at /usr/include/c++/4.9/functional:569
#34 0x00007f909c019dd9 in std::_Bind<std::_Mem_fn<void (WebKit::CoordinatedLayerTreeHost::*)()> (WebKit::CoordinatedLayerTreeHost*)>::__call<void, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) (this=0x1c338a0, __args=<unknown type in webkit/WebKitBuild/Debug/lib/libewebkit2.so.1, CU 0x10504e98, DIE 0x10676d67>) at /usr/include/c++/4.9/functional:1264
#35 0x00007f909c019c51 in std::_Bind<std::_Mem_fn<void (WebKit::CoordinatedLayerTreeHost::*)()> (WebKit::CoordinatedLayerTreeHost*)>::operator()<, void>() (this=0x1c338a0) at /usr/include/c++/4.9/functional:1323
#36 0x00007f909c0199aa in std::_Function_handler<void (), std::_Bind<std::_Mem_fn<void (WebKit::CoordinatedLayerTreeHost::*)()> (WebKit::CoordinatedLayerTreeHost*)> >::_M_invoke(std::_Any_data const&) (__functor=...) at /usr/include/c++/4.9/functional:2039
#37 0x00007f909ba7d392 in std::function<void ()>::operator()() const (this=0x7f907d7e2280) at /usr/include/c++/4.9/functional:2439
#38 0x00007f909bb29baa in WebCore::Timer::fired (this=0x7f907d7e2248) at ../../Source/WebCore/platform/Timer.h:133
#39 0x00007f909c9212cd in WebCore::ThreadTimers::sharedTimerFiredInternal (this=0x7f907d7d6258) at ../../Source/WebCore/platform/ThreadTimers.cpp:121
#40 0x00007f909c920ebb in WebCore::ThreadTimers::<lambda()>::operator()(void) const (__closure=0x1c32ce0) at ../../Source/WebCore/platform/ThreadTimers.cpp:73
#41 0x00007f909c9214de in std::_Function_handler<void(), WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::<lambda()> >::_M_invoke(const std::_Any_data &) (__functor=...) at /usr/include/c++/4.9/functional:2039
#42 0x00007f909ba7d392 in std::function<void ()>::operator()() const (this=0x7f90a17ecae8 <WebCore::MainThreadSharedTimer::singleton()::instance+8>) at /usr/include/c++/4.9/functional:2439
#43 0x00007f909d6b5225 in WebCore::MainThreadSharedTimer::fired (this=0x7f90a17ecae0 <WebCore::MainThreadSharedTimer::singleton()::instance>) at ../../Source/WebCore/platform/MainThreadSharedTimer.cpp:52
#44 0x00007f909d8c32d0 in WebCore::timerEvent () at ../../Source/WebCore/platform/efl/MainThreadSharedTimerEfl.cpp:44
#45 0x00007f9093b24d1e in _ecore_call_task_cb (data=<optimized out>, func=<optimized out>) at lib/ecore/ecore_private.h:336
#46 _ecore_timer_expired_call (when=952777.51855855901) at lib/ecore/ecore_timer.c:733
#47 0x00007f9093b24e6b in _ecore_timer_expired_timers_call (when=952777.51855855901) at lib/ecore/ecore_timer.c:686
#48 0x00007f9093b20b41 in _ecore_main_loop_iterate_internal (once_only=once_only@entry=0) at lib/ecore/ecore_main.c:1812
#49 0x00007f9093b20fc7 in ecore_main_loop_begin () at lib/ecore/ecore_main.c:983
#50 0x00007f90961bd795 in WTF::RunLoop::run () at ../../Source/WTF/wtf/efl/RunLoopEfl.cpp:49
#51 0x00007f909c01d87d in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7ffd45f7d4e8) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61
#52 0x00007f909c01d48b in WebKit::WebProcessMainUnix (argc=2, argv=0x7ffd45f7d4e8) at ../../Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp:161
#53 0x00000000004008ea in main (argc=2, argv=0x7ffd45f7d4e8) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:44

[Brent Fulgham]

This does not reproduce under r204037. If you believe there is still a problem, please reopen the bug and attach a revised test case.