48983 2010-11-04 02:45:35 -0700 REGRESSION: multicol crashes with positioned elements 2012-07-01 06:51:35 -0700 1 1 1 Unclassified WebKit CSS 528+ (Nightly build) PC All RESOLVED FIXED InRadar, Regression P1 Normal --- 84012 1 hamaji webkit-unassigned fred.wang hyatt mitz phanna oldest_to_newest 304547 0 72919 hamaji 2010-11-04 02:45:35 -0700 Created attachment 72919 Test case Recent WebKit crashes with attached HTML. This doesn't happen with Safari 4.0.5. I'm guessing this issue was introduced by dhyatt's recent multicol changes. Corresponding chromium bug: http://code.google.com/p/chromium/issues/detail?id=58101 304548 1 72920 hamaji 2010-11-04 02:50:27 -0700 Created attachment 72920 Test case for the first assertion failure Note that there are two assertion violations in RenderLayer::paintPaginatedChildLayer: ASSERT(!renderer()->isPositioned()); ASSERT(columnLayers.size()); The former assertion failure happens even with a simpler HTML I'm attaching now. The latter assertion failure causes the crash. I'm guessing m_isPaginated should be false for this kind of cases, but I'm not sure. I didn't look into this bug closely at all. 304803 2 ap 2010-11-04 12:41:56 -0700 > This doesn't happen with Safari 4.0.5 Not crashing with 5.0.2 either. 327497 3 skylined 2010-12-29 00:50:24 -0800 This causes one of two NULL ptrs, depending on whether your mouse is hovering over the page or not while reproducing the crash. Reduced repro: <body style="position: absolute; -webkit-column-count: 2;"> <div style="overflow: hidden;"> <img style="position: relative; width: 180px;"> </div> </body> id: chrome.dll!WebCore::RenderLayer::paintChildLayerIntoColumns ReadAV@NULL (3e28197c414363f3d6c613777e35f7b0) description: Attempt to read from unallocated NULL pointer-0x4 in chrome.dll!WebCore::RenderLayer::paintChildLayerIntoColumns application: Chromium 10.0.623.0 stack: chrome.dll!WebCore::RenderLayer::paintChildLayerIntoColumns chrome.dll!WebCore::RenderLayer::paintPaginatedChildLayer chrome.dll!WebCore::RenderLayer::paintList chrome.dll!WebCore::RenderLayer::paintLayer chrome.dll!WebCore::RenderLayer::paintList chrome.dll!WebCore::RenderLayer::paintLayer chrome.dll!WebCore::RenderLayer::paint chrome.dll!WebCore::FrameView::paintContents chrome.dll!WebCore::ScrollView::paint chrome.dll!WebKit::WebFrameImpl::paintWithContext chrome.dll!WebKit::WebFrameImpl::paint chrome.dll!RenderWidget::PaintRect chrome.dll!RenderWidget::DoDeferredUpdate chrome.dll!RenderWidget::CallDoDeferredUpdate chrome.dll!MessageLoop::RunTask chrome.dll!MessageLoop::DoWork chrome.dll!base::MessagePumpDefault::Run chrome.dll!MessageLoop::RunInternal chrome.dll!MessageLoop::Run ... http://trac.webkit.org/browser/trunk/WebCore/rendering/RenderLayer.cpp#L2599 id: chrome.dll!WebCore::RenderLayer::hitTestChildLayerColumns ReadAV@NULL (190d37d7e428d0f0eb541dd4c90591a6) description: Attempt to read from unallocated NULL pointer-0x4 in chrome.dll!WebCore::RenderLayer::hitTestChildLayerColumns application: Chromium 10.0.623.0 stack: chrome.dll!WebCore::RenderLayer::hitTestChildLayerColumns chrome.dll!WebCore::RenderLayer::hitTestPaginatedChildLayer chrome.dll!WebCore::RenderLayer::hitTestList chrome.dll!WebCore::RenderLayer::hitTestLayer chrome.dll!WebCore::RenderLayer::hitTestList chrome.dll!WebCore::RenderLayer::hitTestLayer chrome.dll!WebCore::RenderLayer::hitTest chrome.dll!WebCore::Document::prepareMouseEvent chrome.dll!WebCore::EventHandler::prepareMouseEvent chrome.dll!WebCore::EventHandler::handleMouseMoveEvent chrome.dll!WebCore::EventHandler::mouseMoved chrome.dll!WebKit::WebViewImpl::mouseMove chrome.dll!WebKit::WebViewImpl::handleInputEvent chrome.dll!RenderWidget::OnHandleInputEvent chrome.dll!IPC::Message::Dispatch<...> chrome.dll!RenderWidget::OnMessageReceived chrome.dll!(unknown) chrome.dll!MessageRouter::RouteMessage chrome.dll!MessageRouter::OnMessageReceived chrome.dll!ChildThread::OnMessageReceived chrome.dll!RunnableMethod<ProfileWriter,void chrome.dll!MessageLoop::RunTask chrome.dll!MessageLoop::DoWork chrome.dll!base::MessagePumpDefault::Run chrome.dll!MessageLoop::RunInternal chrome.dll!MessageLoop::Run ... http://trac.webkit.org/browser/trunk/WebCore/rendering/RenderLayer.cpp#L3064 337727 4 ap 2011-01-20 16:59:20 -0800 <rdar://problem/8895977> 374768 5 87204 mitz 2011-03-28 14:15:53 -0700 Created attachment 87204 Update the logic in {paint,hitTest}PaginatedChildLayer() after r68069 374787 6 mitz 2011-03-28 14:33:25 -0700 Fixed in r82158. <http://trac.webkit.org/changeset/82158> 414238 7 steveblock 2011-06-02 10:19:39 -0700 *** Bug 56107 has been marked as a duplicate of this bug. *** 72919 2010-11-04 02:45:35 -0700 2010-11-04 02:45:35 -0700 Test case multicol-crash.html text/html 389 hamaji PGh0bWw+Cgo8aGVhZD4KCjxzdHlsZT4KICAgIC5zZWN0aW9uIHsKICAgICAgICBwb3NpdGlvbjog YWJzb2x1dGU7CiAgICAgICAgLW1vei1jb2x1bW4tY291bnQ6IDI7CiAgICAgICAgLXdlYmtpdC1j b2x1bW4tY291bnQ6IDI7CiAgICB9CiAgICAuZ3JhcGggewogICAgICAgIG92ZXJmbG93OiBoaWRk ZW47CiAgICB9CiAgICAuaW1nIHsKICAgICAgICBwb3NpdGlvbjogcmVsYXRpdmU7CiAgICAgICAg d2lkdGg6IDE4MHB4OwogICAgfQo8L3N0eWxlPgoKPC9oZWFkPgoKPGJvZHk+CgogIDxkaXYgY2xh c3M9InNlY3Rpb24iPgogICAgPGRpdiBjbGFzcz0iZ3JhcGgiPgogICAgICA8ZGl2IGNsYXNzPSJp bWciPjwvZGl2PgogICAgPC9kaXY+CiAgPC9kaXY+Cgo8L2JvZHk+PC9odG1sPgo= 72920 2010-11-04 02:50:27 -0700 2010-11-04 02:50:27 -0700 Test case for the first assertion failure multicol-assert.html text/html 212 hamaji PGh0bWw+Cgo8aGVhZD4KCjxzdHlsZT4KICAgIC5zZWN0aW9uIHsKICAgICAgICBwb3NpdGlvbjog YWJzb2x1dGU7CiAgICAgICAgLW1vei1jb2x1bW4tY291bnQ6IDI7CiAgICAgICAgLXdlYmtpdC1j b2x1bW4tY291bnQ6IDI7CiAgICB9Cjwvc3R5bGU+Cgo8L2hlYWQ+Cgo8Ym9keT4KCiAgPGRpdiBj bGFzcz0ic2VjdGlvbiI+CiAgPC9kaXY+Cgo8L2JvZHk+PC9odG1sPgo= 87204 2011-03-28 14:15:53 -0700 2011-03-28 14:17:35 -0700 Update the logic in {paint,hitTest}PaginatedChildLayer() after r68069 8895977_r1.diff text/plain 4471 mitz SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDgyMTU0KQorKysgU291cmNlL1dlYkNvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTcgQEAKKzIwMTEtMDMtMjggIERhbiBCZXJu c3RlaW4gIDxtaXR6QGFwcGxlLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KKworICAgICAgICA8cmRhcjovL3Byb2JsZW0vODg5NTk3Nz4gUkVHUkVTU0lPTjogbXVs dGljb2wgY3Jhc2hlcyB3aXRoIHBvc2l0aW9uZWQgZWxlbWVudHMKKyAgICAgICAgaHR0cHM6Ly9i dWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTQ4OTgzCisKKyAgICAgICAgVGVzdDogZmFz dC9tdWx0aWNvbC9wYWdpbmF0ZWQtbGF5ZXItY3Jhc2guaHRtbAorCisgICAgICAgICogcmVuZGVy aW5nL1JlbmRlckxheWVyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlJlbmRlckxheWVyOjpwYWlu dFBhZ2luYXRlZENoaWxkTGF5ZXIpOiBCcmluZyB0aGUgbG9naWMgZm9yIGZpbmRpbmcgcGFnaW50 YXRpbmcgbGF5ZXJzCisgICAgICAgIGludG8gc3luYyB3aXRoIHVwZGF0ZVBhZ2luYXRpb24oKSBh ZnRlciByNjgwNjkuCisgICAgICAgIChXZWJDb3JlOjpSZW5kZXJMYXllcjo6aGl0VGVzdFBhZ2lu YXRlZENoaWxkTGF5ZXIpOiBEaXR0by4KKwogMjAxMS0wMy0yOCAgTWFjaWVqIFN0YWNob3dpYWsg IDxtanNAYXBwbGUuY29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5IERhcmluIEFkbGVyJyAuCklu ZGV4OiBTb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyTGF5ZXIuY3BwCj09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K LS0tIFNvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJMYXllci5jcHAJKHJldmlzaW9uIDgy MTIyKQorKysgU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckxheWVyLmNwcAkod29ya2lu ZyBjb3B5KQpAQCAtMjYyNiw5ICsyNjI2LDkgQEAgdm9pZCBSZW5kZXJMYXllcjo6cGFpbnRQYWdp bmF0ZWRDaGlsZExheQogICAgIFZlY3RvcjxSZW5kZXJMYXllcio+IGNvbHVtbkxheWVyczsKICAg ICBSZW5kZXJMYXllciogYW5jZXN0b3JMYXllciA9IGlzTm9ybWFsRmxvd09ubHkoKSA/IHBhcmVu dCgpIDogc3RhY2tpbmdDb250ZXh0KCk7CiAgICAgZm9yIChSZW5kZXJMYXllciogY3VyciA9IGNo aWxkTGF5ZXItPnBhcmVudCgpOyBjdXJyOyBjdXJyID0gY3Vyci0+cGFyZW50KCkpIHsKLSAgICAg ICAgaWYgKGN1cnItPnJlbmRlcmVyKCktPmhhc0NvbHVtbnMoKSkKKyAgICAgICAgaWYgKGN1cnIt PnJlbmRlcmVyKCktPmhhc0NvbHVtbnMoKSAmJiBjaGVja0NvbnRhaW5pbmdCbG9ja0NoYWluRm9y UGFnaW5hdGlvbihjaGlsZExheWVyLT5yZW5kZXJlcigpLCBjdXJyLT5yZW5kZXJCb3goKSkpCiAg ICAgICAgICAgICBjb2x1bW5MYXllcnMuYXBwZW5kKGN1cnIpOwotICAgICAgICBpZiAoY3VyciA9 PSBhbmNlc3RvckxheWVyIHx8IChjdXJyLT5wYXJlbnQoKSAmJiBjdXJyLT5wYXJlbnQoKS0+cmVu ZGVyZXIoKS0+aXNQb3NpdGlvbmVkKCkpKQorICAgICAgICBpZiAoY3VyciA9PSBhbmNlc3Rvckxh eWVyKQogICAgICAgICAgICAgYnJlYWs7CiAgICAgfQogCkBAIC0zMTAxLDkgKzMxMDEsOSBAQCBS ZW5kZXJMYXllciogUmVuZGVyTGF5ZXI6OmhpdFRlc3RQYWdpbmF0CiAgICAgVmVjdG9yPFJlbmRl ckxheWVyKj4gY29sdW1uTGF5ZXJzOwogICAgIFJlbmRlckxheWVyKiBhbmNlc3RvckxheWVyID0g aXNOb3JtYWxGbG93T25seSgpID8gcGFyZW50KCkgOiBzdGFja2luZ0NvbnRleHQoKTsKICAgICBm b3IgKFJlbmRlckxheWVyKiBjdXJyID0gY2hpbGRMYXllci0+cGFyZW50KCk7IGN1cnI7IGN1cnIg PSBjdXJyLT5wYXJlbnQoKSkgewotICAgICAgICBpZiAoY3Vyci0+cmVuZGVyZXIoKS0+aGFzQ29s dW1ucygpKQorICAgICAgICBpZiAoY3Vyci0+cmVuZGVyZXIoKS0+aGFzQ29sdW1ucygpICYmIGNo ZWNrQ29udGFpbmluZ0Jsb2NrQ2hhaW5Gb3JQYWdpbmF0aW9uKGNoaWxkTGF5ZXItPnJlbmRlcmVy KCksIGN1cnItPnJlbmRlckJveCgpKSkKICAgICAgICAgICAgIGNvbHVtbkxheWVycy5hcHBlbmQo Y3Vycik7Ci0gICAgICAgIGlmIChjdXJyID09IGFuY2VzdG9yTGF5ZXIgfHwgKGN1cnItPnBhcmVu dCgpICYmIGN1cnItPnBhcmVudCgpLT5yZW5kZXJlcigpLT5pc1Bvc2l0aW9uZWQoKSkpCisgICAg ICAgIGlmIChjdXJyID09IGFuY2VzdG9yTGF5ZXIpCiAgICAgICAgICAgICBicmVhazsKICAgICB9 CiAKSW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0 cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDgyMTU0KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3 b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTMgQEAKKzIwMTEtMDMtMjggIERhbiBCZXJuc3RlaW4g IDxtaXR6QGFwcGxlLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4K KworICAgICAgICA8cmRhcjovL3Byb2JsZW0vODg5NTk3Nz4gUkVHUkVTU0lPTjogbXVsdGljb2wg Y3Jhc2hlcyB3aXRoIHBvc2l0aW9uZWQgZWxlbWVudHMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndl YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTQ4OTgzCisKKyAgICAgICAgKiBmYXN0L211bHRpY29s L3BhZ2luYXRlZC1sYXllci1jcmFzaC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZh c3QvbXVsdGljb2wvcGFnaW5hdGVkLWxheWVyLWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDExLTAz LTI4ICBNYWNpZWogU3RhY2hvd2lhayAgPG1qc0BhcHBsZS5jb20+CiAKICAgICAgICAgUmV2aWV3 ZWQgYnkgRGFyaW4gQWRsZXInIC4KSW5kZXg6IExheW91dFRlc3RzL2Zhc3QvbXVsdGljb2wvcGFn aW5hdGVkLWxheWVyLWNyYXNoLWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0 cy9mYXN0L211bHRpY29sL3BhZ2luYXRlZC1sYXllci1jcmFzaC1leHBlY3RlZC50eHQJKHJldmlz aW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L211bHRpY29sL3BhZ2luYXRlZC1sYXllci1jcmFz aC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsNSBAQAorVGVzdCBmb3IgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTQ4OTgzIFJFR1JFU1NJT046IG11 bHRpY29sIGNyYXNoZXMgd2l0aCBwb3NpdGlvbmVkIGVsZW1lbnRzLgorCitUaGlzIHRlc3Qgc2hv dWxkIG5vdCBjYXVzZSBhIGNyYXNoLgorCisKSW5kZXg6IExheW91dFRlc3RzL2Zhc3QvbXVsdGlj b2wvcGFnaW5hdGVkLWxheWVyLWNyYXNoLmh0bWwKPT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMv ZmFzdC9tdWx0aWNvbC9wYWdpbmF0ZWQtbGF5ZXItY3Jhc2guaHRtbAkocmV2aXNpb24gMCkKKysr IExheW91dFRlc3RzL2Zhc3QvbXVsdGljb2wvcGFnaW5hdGVkLWxheWVyLWNyYXNoLmh0bWwJKHJl dmlzaW9uIDApCkBAIC0wLDAgKzEsMzEgQEAKKzxzdHlsZT4KKyAgICAuc2VjdGlvbiB7CisgICAg ICAgIHBvc2l0aW9uOiBhYnNvbHV0ZTsKKyAgICAgICAgLXdlYmtpdC1jb2x1bW4tY291bnQ6IDI7 CisgICAgfQorCisgICAgLmdyYXBoIHsKKyAgICAgICAgb3ZlcmZsb3c6IGhpZGRlbjsKKyAgICB9 CisKKyAgICAuaW1nIHsKKyAgICAgICAgcG9zaXRpb246IHJlbGF0aXZlOworICAgICAgICB3aWR0 aDogMTgwcHg7CisgICAgfQorPC9zdHlsZT4KKzxwPgorICAgIFRlc3QgZm9yIDxpPjxhIGhyZWY9 Imh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD00ODk4MyI+aHR0cHM6Ly9i dWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTQ4OTgzPC9hPgorICAgIFJFR1JFU1NJT046 IG11bHRpY29sIGNyYXNoZXMgd2l0aCBwb3NpdGlvbmVkIGVsZW1lbnRzPC9pPi4KKzwvcD4KKzxw PgorICAgIFRoaXMgdGVzdCBzaG91bGQgbm90IGNhdXNlIGEgY3Jhc2guCis8L3A+Cis8ZGl2IGNs YXNzPSJzZWN0aW9uIj4KKyAgICA8ZGl2IGNsYXNzPSJncmFwaCI+CisgICAgICAgIDxkaXYgY2xh c3M9ImltZyI+PC9kaXY+CisgICAgPC9kaXY+Cis8L2Rpdj4KKzxzY3JpcHQ+CisgICAgaWYgKHdp bmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikKKyAgICAgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIu ZHVtcEFzVGV4dCgpOworPC9zY3JpcHQ+Cg==