RESOLVED FIXED 278100
[Debug] ASSERTION FAILED: !flow.spannerMap().get(placeholder->spanner()) in `fast/multicol/span/float-becomes-spanner-crash.html` 
https://bugs.webkit.org/show_bug.cgi?id=278100
Summary [Debug] ASSERTION FAILED: !flow.spannerMap().get(placeholder->spanner()) in `...
Vitaly Dyackhov
Reported 2024-08-14 06:34:54 PDT
STDERR: ASSERTION FAILED: !flow.spannerMap().get(placeholder->spanner()) STDERR: /home/vitaly/WebKit/Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp(302) : void WebCore::RenderTreeBuilder::MultiColumn::multiColumnDescendantInserted(WebCore::RenderMultiColumnFlow&, WebCore::RenderObject&) STDERR: 1 0x7f1e0e4d1b5e WebCore::RenderTreeBuilder::MultiColumn::multiColumnDescendantInserted(WebCore::RenderMultiColumnFlow&, WebCore::RenderObject&) STDERR: 2 0x7f1e0e4bb78a WebCore::RenderTreeBuilder::attachToRenderElementInternal(WebCore::RenderElement&, std::unique_ptr<WebCore::RenderObject, WebCore::RenderObjectDeleter>, WebCore::RenderObject*) STDERR: 3 0x7f1e0e4ce6aa WebCore::RenderTreeBuilder::Inline::splitFlow(WebCore::RenderInline&, WebCore::RenderObject*, std::unique_ptr<WebCore::RenderBlock, WebCore::RenderObjectDeleter>, std::unique_ptr<WebCore::RenderObject, WebCore::RenderObjectDeleter>, WebCore::RenderBoxModelObject*) STDERR: 4 0x7f1e0e4ce245 WebCore::RenderTreeBuilder::Inline::attachIgnoringContinuation(WebCore::RenderInline&, std::unique_ptr<WebCore::RenderObject, WebCore::RenderObjectDeleter>, WebCore::RenderObject*) STDERR: 5 0x7f1e0e4cdaf1 WebCore::RenderTreeBuilder::Inline::attach(WebCore::RenderInline&, std::unique_ptr<WebCore::RenderObject, WebCore::RenderObjectDeleter>, WebCore::RenderObject*) STDERR: 6 0x7f1e0e4baa7f WebCore::RenderTreeBuilder::attachInternal(WebCore::RenderElement&, std::unique_ptr<WebCore::RenderObject, WebCore::RenderObjectDeleter>, WebCore::RenderObject*) STDERR: 7 0x7f1e0e4b9c63 WebCore::RenderTreeBuilder::attach(WebCore::RenderElement&, std::unique_ptr<WebCore::RenderObject, WebCore::RenderObjectDeleter>, WebCore::RenderObject*) STDERR: 8 0x7f1e0e4dfd40 WebCore::RenderTreeUpdater::createRenderer(WebCore::Element&, WebCore::RenderStyle&&) STDERR: 9 0x7f1e0e4df902 WebCore::RenderTreeUpdater::updateElementRenderer(WebCore::Element&, WebCore::Style::ElementUpdate const&) STDERR: 10 0x7f1e0e4de9ba WebCore::RenderTreeUpdater::updateRenderTree(WebCore::ContainerNode&) STDERR: 11 0x7f1e0e4ddc49 WebCore::RenderTreeUpdater::commit(std::unique_ptr<WebCore::Style::Update, std::default_delete<WebCore::Style::Update> >) STDERR: 12 0x7f1e0c5bea97 WebCore::Document::updateRenderTree(std::unique_ptr<WebCore::Style::Update, std::default_delete<WebCore::Style::Update> >) STDERR: 13 0x7f1e0c5bf4d9 WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) STDERR: 14 0x7f1e0c5bfd19 WebCore::Document::updateStyleIfNeeded() STDERR: 15 0x7f1e0c5c0118 WebCore::Document::updateLayout(WTF::OptionSet<WebCore::LayoutOptions>, WebCore::Element const*) STDERR: 16 0x7f1e0c5bfdb2 WebCore::Document::updateLayoutIgnorePendingStylesheets(WTF::OptionSet<WebCore::LayoutOptions>, WebCore::Element const*) STDERR: 17 0x7f1e0c6a3a35 WebCore::Element::offsetTop() STDERR: 18 0x7f1e0c6a37a4 WebCore::Element::offsetTopForBindings() STDERR: 19 0x7f1e09e1b18a jsHTMLElement_offsetTopGetter STDERR: 20 0x7f1e09e48121 get<WebCore::jsHTMLElement_offsetTopGetter, (WebCore::CastedThisErrorBehavior)3> STDERR: 21 0x7f1e09e1b203 jsHTMLElement_offsetTop STDERR: 22 0x7f1dfbcf1bd6 WTF::FunctionPtr<(WTF::PtrTag)57072, long (JSC::JSGlobalObject*, long, JSC::PropertyName), (WTF::FunctionAttributes)1>::operator()(JSC::JSGlobalObject*, long, JSC::PropertyName) const STDERR: 23 0x7f1dfbf939ae JSC::PropertySlot::customGetter(JSC::VM&, JSC::PropertyName) const STDERR: 24 0x7f1dfa087d92 JSC::PropertySlot::getValue(JSC::JSGlobalObject*, JSC::PropertyName) const STDERR: 25 0x7f1dfa0b3354 JSC::JSValue::get(JSC::JSGlobalObject*, JSC::PropertyName, JSC::PropertySlot&) const STDERR: 26 0x7f1dfb8a9449 performLLIntGetByID STDERR: 27 0x7f1dfb8a9cb4 llint_slow_path_get_by_id STDERR: 28 0x7f1dfa019dc3 llint_op_get_by_id
Attachments
Add attachment proposed patch, testcase, etc.
Vitaly Dyackhov
Comment 1 2024-08-14 06:45:25 PDT
Pull request: https://github.com/WebKit/WebKit/pull/32195
Radar WebKit Bug Importer
Comment 2 2024-08-21 06:35:16 PDT
<rdar://problem/134414694>
EWS
Comment 3 2024-08-27 07:58:27 PDT
Committed 282788@main (3ea9a89c350e): <https://commits.webkit.org/282788@main> Reviewed commits have been landed. Closing PR #32195 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.