56107 2011-03-10 08:34:13 -0800 REGRESSION: Crash in paintPaginatedChildLayers 2011-06-02 10:19:39 -0700 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) PC OS X 10.5 RESOLVED DUPLICATE 48983 InRadar, Regression P1 Normal --- 1 phanna webkit-unassigned ap steveblock oldest_to_newest 365205 0 85335 phanna 2011-03-10 08:34:13 -0800 Created attachment 85335 Test case If a layer is paginated but has a grandparent that is positioned, paintPaginatedChildLayers crashes due to columnLayers being empty. Attached is a test html file. My simple fix was to remove the logic in paintPaginatedChildLayers that checks for curr->parent()->renderer()->isPositioned() similar to updatePagination. 365308 1 ap 2011-03-10 10:48:07 -0800 I can reproduce with r80210 nightly, cannot reproduce with Safari 5.0.4. With a debug build, there is an assertion failing: ASSERTION FAILED: columnLayers.size() /Users/ap/Safari/OpenSource/Source/WebCore/rendering/RenderLayer.cpp(2586) : void WebCore::RenderLayer::paintPaginatedChildLayer(WebCore::RenderLayer*, WebCore::RenderLayer*, WebCore::GraphicsContext*, const WebCore::IntRect&, WebCore::PaintBehavior, WebCore::RenderObject*, WebCore::OverlapTestRequestMap*, unsigned int) 1 WebCore::RenderLayer::paintPaginatedChildLayer(WebCore::RenderLayer*, WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::RenderObject*, WTF::HashMap<WebCore::OverlapTestRequestClient*, WebCore::IntRect, WTF::PtrHash<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::IntRect> >*, unsigned int) 2 WebCore::RenderLayer::paintList(WTF::Vector<WebCore::RenderLayer*, 0ul>*, WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::RenderObject*, WTF::HashMap<WebCore::OverlapTestRequestClient*, WebCore::IntRect, WTF::PtrHash<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::IntRect> >*, unsigned int) 3 WebCore::RenderLayer::paintLayer(WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::RenderObject*, WTF::HashMap<WebCore::OverlapTestRequestClient*, WebCore::IntRect, WTF::PtrHash<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::IntRect> >*, unsigned int) 4 WebCore::RenderLayer::paintList(WTF::Vector<WebCore::RenderLayer*, 0ul>*, WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::RenderObject*, WTF::HashMap<WebCore::OverlapTestRequestClient*, WebCore::IntRect, WTF::PtrHash<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::IntRect> >*, unsigned int) 5 WebCore::RenderLayer::paintLayer(WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::RenderObject*, WTF::HashMap<WebCore::OverlapTestRequestClient*, WebCore::IntRect, WTF::PtrHash<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::IntRect> >*, unsigned int) 6 WebCore::RenderLayer::paint(WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::RenderObject*) 7 WebCore::FrameView::paintContents(WebCore::GraphicsContext*, WebCore::IntRect const&) 365309 2 ap 2011-03-10 10:48:28 -0800 <rdar://problem/9115675> 394166 3 ap 2011-04-27 20:59:50 -0700 I cannot reproduce in r84740 any more. 414237 4 steveblock 2011-06-02 10:19:39 -0700 This looks like a duplicate of Bug 48983, which was fixed in http://trac.webkit.org/changeset/82158 *** This bug has been marked as a duplicate of bug 48983 *** 85335 2011-03-10 08:34:13 -0800 2011-03-10 08:34:13 -0800 Test case columns.html text/html 5938 phanna PGh0bWw+CiAgPGhlYWQ+CiAgICA8c3R5bGUgdHlwZT0idGV4dC9jc3MiPgogICAgICAjY29udGVu dCB7CiAgICAgICAgYm9yZGVyOiAwOwogICAgICAgIGxlZnQ6IDA7CiAgICAgICAgbWFyZ2luOiAw OwogICAgICAgIHBhZGRpbmc6IDA7CiAgICAgICAgcG9zaXRpb246IGFic29sdXRlOwogICAgICAg IC13ZWJraXQtY29sdW1uLWNvdW50IDogNTsKICAgICAgICAtd2Via2l0LWNvbHVtbi1maWxsOiBh dXRvOwogICAgICAgIC13ZWJraXQtY29sdW1uLWdhcDogMDsKICAgICAgICAtd2Via2l0LWh5cGhl bnM6IGF1dG87CiAgICAgIH0KICAgIDwvc3R5bGU+CiAgPC9oZWFkPgogIDxib2R5PgogICAgPGRp diBpZD0iY29udGVudCI+CiAgICAgIDxkaXYgc3R5bGU9InBvc2l0aW9uOnJlbGF0aXZlIj4KICAg ICAgICA8ZGl2IHN0eWxlPSJwb3NpdGlvbjpyZWxhdGl2ZSI+CiAgICAgICAgICBMb3JlbSBpcHN1 bSBkb2xvciBzaXQgYW1ldCwgY29uc2VjdGV0dXIgYWRpcGlzY2luZyBlbGl0LiBOdWxsYSBlZ2V0 IHR1cnBpcyBxdWlzCiAgICAgICAgICBtYXNzYSBsdWN0dXMgbG9ib3J0aXMuIEludGVnZXIgcGVs bGVudGVzcXVlIG1hdHRpcyB0aW5jaWR1bnQuIERvbmVjIGluIG1hdHRpcwogICAgICAgICAgZXJh dC4gTG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2NpbmcgZWxp dC4gQWxpcXVhbSB0aW5jaWR1bnQKICAgICAgICAgIHN1c2NpcGl0IGVyYXQgdXQgZmF1Y2lidXMu IERvbmVjIGVsZWlmZW5kIHZlbGl0IHF1aXMgbWFnbmEgZGFwaWJ1cyBoZW5kcmVyaXQuIEluCiAg ICAgICAgICB2ZXN0aWJ1bHVtIG51bmMgdmVsIHRvcnRvciBmYWNpbGlzaXMgY29uc2VjdGV0dXIu IFN1c3BlbmRpc3NlIGxvcmVtIGF1Z3VlLAogICAgICAgICAgdml2ZXJyYSB2ZWwgdWxsYW1jb3Jw ZXIgdmVsLCB0aW5jaWR1bnQgYXQgYXVndWUuIER1aXMgc2l0IGFtZXQgdmVsaXQgaWQgb2Rpbwog ICAgICAgICAgaWFjdWxpcyBpbXBlcmRpZXQgc2VkIHV0IHF1YW0uIFZlc3RpYnVsdW0gdmVuZW5h dGlzIG9yY2kgaW4gcXVhbSBhZGlwaXNjaW5nCiAgICAgICAgICBhY2N1bXNhbi4gU3VzcGVuZGlz c2UgcG90ZW50aS4gU3VzcGVuZGlzc2UgcHVsdmluYXIgbGFjaW5pYSBsaWJlcm8gZXQgcG9ydGEu CiAgICAgICAgICBQaGFzZWxsdXMgaW4gc29kYWxlcyBwdXJ1cy4gRXRpYW0gZXUgdHVycGlzIHVy bmEsIHV0IHBvc3VlcmUgZG9sb3IuIFV0IGZhY2lsaXNpcwogICAgICAgICAgZWdlc3RhcyBsaWd1 bGEsIG5vbiBtYXR0aXMgc2VtIGxhY2luaWEgZWdldC4gVml2YW11cyBwb3J0dGl0b3IgbGFjaW5p YSBlbGl0CiAgICAgICAgICBzb2xsaWNpdHVkaW4gdWx0cmljaWVzLiBTdXNwZW5kaXNzZSBtYWxl c3VhZGEgbWFzc2Egc2VkIHNhcGllbiBjb25ndWUgbm9uCiAgICAgICAgICBlbGVpZmVuZCBmZWxp cyBkaWN0dW0uIEN1cmFiaXR1ciBmZXJtZW50dW0gYXJjdSBuZWMgbmVxdWUgZWxlaWZlbmQgY29u c2VxdWF0LgogICAgICAgICAgUHJhZXNlbnQgbGVvIHVybmEsIGN1cnN1cyBhIGNvbnNlcXVhdCBh dCwgZ3JhdmlkYSBwZWxsZW50ZXNxdWUgbWV0dXMuIFZlc3RpYnVsdW0KICAgICAgICAgIGJsYW5k aXQsIHNlbSBxdWlzIHBvcnRhIHBvc3VlcmUsIHF1YW0gdGVsbHVzIHZhcml1cyBlcmF0LCBwb3J0 dGl0b3IgYmliZW5kdW0KICAgICAgICAgIG5pYmggbnVsbGEgZWdldCB0b3J0b3IuCiAgICAgICAg PC9kaXY+CiAgICAgIDwvZGl2PgoKICAgICAgPGRpdiBzdHlsZT0icG9zaXRpb246cmVsYXRpdmUi PgogICAgICAgIEFlbmVhbiBkaWN0dW0gY29tbW9kbyBlbGl0IHF1aXMgZmF1Y2lidXMuIEV0aWFt IGZlcm1lbnR1bSBtb2xlc3RpZSBncmF2aWRhLgogICAgICAgIEludGVnZXIgZW5pbSBuaXNpLCB0 ZW1wb3IgYWNjdW1zYW4gaW1wZXJkaWV0IHNlZCwgY29uc2VxdWF0IGF0IHF1YW0uIE51bmMgdXQK ICAgICAgICBlbmltIHB1cnVzLiBJbnRlZ2VyIGlkIGxpZ3VsYSBpcHN1bSwgdml0YWUgcmhvbmN1 cyBsb3JlbS4gSW4gbG9ib3J0aXMgbmVxdWUgbmVjCiAgICAgICAgbmVxdWUgYmliZW5kdW0gc2Vk IHZpdmVycmEgbnVuYyBtb2xlc3RpZS4gQ3JhcyBhIGltcGVyZGlldCB0b3J0b3IuIFNlZCBtb2xs aXMKICAgICAgICBmYWNpbGlzaXMgc2VtIGlkIHBvc3VlcmUuIEFsaXF1YW0gY3Vyc3VzIHZlbGl0 IHV0IG51bGxhIHNvbGxpY2l0dWRpbiBjdXJzdXMuCiAgICAgICAgU3VzcGVuZGlzc2UgcG90ZW50 aS4gVmVzdGlidWx1bSBkaWduaXNzaW0gdXJuYSBhdCBtZXR1cyBjb25ndWUgY29tbW9kby4gTnVs bGEKICAgICAgICB0ZWxsdXMgZGlhbSwgYWxpcXVhbSB2ZWwgcmhvbmN1cyBydXRydW0sIG1hbGVz dWFkYSBldSBuZXF1ZS4gQWxpcXVhbSBpYWN1bGlzCiAgICAgICAgbW9sbGlzIG5lcXVlLCBhdCBj b25zZXF1YXQgbWV0dXMgaW50ZXJkdW0gc2l0IGFtZXQuIE1hdXJpcyBlZ2V0IG51bGxhIGxlY3R1 cywgYQogICAgICAgIGxhY2luaWEgZW5pbS4gRG9uZWMgcHVsdmluYXIgcG9ydGEgcGVsbGVudGVz cXVlLiBJbiBoYWMgaGFiaXRhc3NlIHBsYXRlYQogICAgICAgIGRpY3R1bXN0LiBNYWVjZW5hcyB2 ZW5lbmF0aXMgZGljdHVtIHZvbHV0cGF0LiBMb3JlbSBpcHN1bSBkb2xvciBzaXQgYW1ldCwKICAg ICAgICBjb25zZWN0ZXR1ciBhZGlwaXNjaW5nIGVsaXQuIEluIGhhYyBoYWJpdGFzc2UgcGxhdGVh IGRpY3R1bXN0LgogICAgICA8L2Rpdj4KCiAgICAgIDxkaXYgc3R5bGU9InBvc2l0aW9uOnJlbGF0 aXZlIj4KICAgICAgICBWaXZhbXVzIHB1bHZpbmFyIGZlbGlzIGluIG1pIGNvbnZhbGxpcyBpbXBl cmRpZXQuIFV0IG1vbGVzdGllIGRvbG9yIGV0IG1hZ25hCiAgICAgICAgcG9ydHRpdG9yIHNlZCBl bGVpZmVuZCBsYWN1cyB2ZWhpY3VsYS4gUGVsbGVudGVzcXVlIHNpdCBhbWV0IGxvYm9ydGlzIHB1 cnVzLiBTZWQKICAgICAgICBjb25kaW1lbnR1bSBhbGlxdWFtIG9kaW8sIHV0IGJpYmVuZHVtIG1l dHVzIGx1Y3R1cyBhdC4gUGVsbGVudGVzcXVlIHN1c2NpcGl0CiAgICAgICAgYW50ZSBub24gbGli ZXJvIGJpYmVuZHVtIGF0IGRpZ25pc3NpbSBtYXVyaXMgdGluY2lkdW50LiBOdWxsYSBmYWNpbGlz aS4KICAgICAgICBTdXNwZW5kaXNzZSBncmF2aWRhIGFkaXBpc2NpbmcgZXJhdCwgc2l0IGFtZXQg dWx0cmljZXMgbGliZXJvIHZlc3RpYnVsdW0gc2VkLgogICAgICAgIFN1c3BlbmRpc3NlIGEgbmli aCBtYXNzYSwgcXVpcyBzb2xsaWNpdHVkaW4gbmlzbC4gU3VzcGVuZGlzc2UgZmV1Z2lhdCBhbGlx dWV0CiAgICAgICAgZGlhbSwgcXVpcyBsdWN0dXMgaXBzdW0gdmVoaWN1bGEgbm9uLiBTdXNwZW5k aXNzZSBwb3RlbnRpLiBOdW5jIHZ1bHB1dGF0ZSBkaWFtCiAgICAgICAgcXVpcyBtYXNzYSBlbGVt ZW50dW0gdGVtcG9yLiBTdXNwZW5kaXNzZSBkb2xvciBlcmF0LCB2ZWhpY3VsYSBpbiBlbGVtZW50 dW0gZXUsCiAgICAgICAgc29sbGljaXR1ZGluIHF1aXMgc2FwaWVuLiBTdXNwZW5kaXNzZSBwb3Rl bnRpLiBTdXNwZW5kaXNzZSBldSB1cm5hIG5vbiBuaXNsCiAgICAgICAgc2NlbGVyaXNxdWUgbW9s ZXN0aWUgdml0YWUgcXVpcyBuaXNpLiBOdWxsYW0gcHJldGl1bSBncmF2aWRhIGxhY3VzIGlkIGVn ZXN0YXMuCiAgICAgIDwvZGl2PgoKICAgICAgPGRpdiBzdHlsZT0icG9zaXRpb246cmVsYXRpdmUi PgogICAgICAgIENyYXMgcmlzdXMgYW50ZSwgY29udmFsbGlzIHZpdGFlIGJpYmVuZHVtIHZlbCwg Y29uZGltZW50dW0gZXQgcXVhbS4gQ3VyYWJpdHVyCiAgICAgICAgYXVndWUgdXJuYSwgZGlnbmlz c2ltIHNpdCBhbWV0IHBvcnR0aXRvciBhdCwgcHVsdmluYXIgcGVsbGVudGVzcXVlIGxlby4gRG9u ZWMKICAgICAgICBjb252YWxsaXMgdWxsYW1jb3JwZXIgb3JjaSwgcXVpcyBhY2N1bXNhbiBmZWxp cyBsYW9yZWV0IG5lYy4gQ3VyYWJpdHVyIGxvcmVtCiAgICAgICAgb3JjaSwgZGljdHVtIHF1aXMg cG9zdWVyZSBhdCwgdmVoaWN1bGEgaWQgcmlzdXMuIFV0IHNhcGllbiBqdXN0bywgY29uZGltZW50 dW0KICAgICAgICBxdWlzIGVsZW1lbnR1bSB2ZWwsIGVnZXN0YXMgZmF1Y2lidXMgdmVsaXQuIFZl c3RpYnVsdW0gc2FnaXR0aXMgY3Vyc3VzIG5pc2wgaW4KICAgICAgICBjb25kaW1lbnR1bS4gQWxp cXVhbSBlc3QgbWFnbmEsIGF1Y3RvciBldCB1bHRyaWNlcyBwcmV0aXVtLCBpbnRlcmR1bSBldSB0 b3J0b3IuCiAgICAgICAgTW9yYmkgbHVjdHVzIG5lcXVlIHNlZCBlc3QgZXVpc21vZCBldCBzdXNj aXBpdCBzZW0gYWRpcGlzY2luZy4gUGhhc2VsbHVzIGFyY3UKICAgICAgICB0b3J0b3IsIGludGVy ZHVtIGVnZXQgc29sbGljaXR1ZGluIHZlbCwgc2NlbGVyaXNxdWUgZWdldCBsZWN0dXMuIFN1c3Bl bmRpc3NlCiAgICAgICAgcG90ZW50aS4gTnVuYyB2b2x1dHBhdCBudW5jIHZlbCBlc3QgZGljdHVt IHNjZWxlcmlzcXVlLiBTdXNwZW5kaXNzZSB2aXRhZQogICAgICAgIHZlc3RpYnVsdW0gbmliaC4g U3VzcGVuZGlzc2UgcG90ZW50aS4gVml2YW11cyBzZW1wZXIgZG9sb3IgYWMgYXVndWUgbWF0dGlz CiAgICAgICAgdWx0cmljZXMuIERvbmVjIHZlbCB2aXZlcnJhIG5pc2kuIFByYWVzZW50IGFjY3Vt c2FuIGFudGUgaW4gbGlndWxhIGNvbnNlcXVhdCBub24KICAgICAgICBzdXNjaXBpdCBsYWN1cyBk YXBpYnVzLiBNb3JiaSBkaWN0dW0gYXVjdG9yIHZlbmVuYXRpcy4gUGhhc2VsbHVzIGF1Y3Rvciwg c2FwaWVuCiAgICAgICAgdXQgZGFwaWJ1cyBhY2N1bXNhbiwgZW5pbSBtZXR1cyBkaWduaXNzaW0g YXJjdSwgbm9uIG9ybmFyZSBvcmNpIG1hc3NhIHNpdCBhbWV0CiAgICAgICAgb3JjaS4KICAgICAg PC9kaXY+CgogICAgICA8ZGl2IHN0eWxlPSJwb3NpdGlvbjpyZWxhdGl2ZSI+CiAgICAgICAgRG9u ZWMgbmVjIG5pYmggbWksIHF1aXMgYWxpcXVldCB1cm5hLiBQZWxsZW50ZXNxdWUgbHVjdHVzIHR1 cnBpcyBlZ2V0IGF1Z3VlCiAgICAgICAgdHJpc3RpcXVlIG5vbiBmZXJtZW50dW0gbWkgY29uZGlt ZW50dW0uIEZ1c2NlIG1hdHRpcyBsZWN0dXMgdXQgcXVhbSBjb25zZXF1YXQKICAgICAgICBwaGFy ZXRyYS4gUGVsbGVudGVzcXVlIGFjIHZlbGl0IHNlZCBhcmN1IGZyaW5naWxsYSBzb2RhbGVzIGVn ZXQgdmVsIG5lcXVlLgogICAgICAgIE51bGxhbSBmYXVjaWJ1cyBjb25zZXF1YXQgbGlndWxhLCBh YyBpbXBlcmRpZXQgbGVvIG1vbGVzdGllIGluLiBGdXNjZSBwb3N1ZXJlCiAgICAgICAgYXVndWUg c2VkIHRlbGx1cyBvcm5hcmUgYWMgYWRpcGlzY2luZyBlcm9zIGRhcGlidXMuIFN1c3BlbmRpc3Nl IGFsaXF1ZXQgcmlzdXMgYWMKICAgICAgICBsYWN1cyBydXRydW0gZWdldCBkYXBpYnVzIHNhcGll biBzb2RhbGVzLiBNb3JiaSBuZWMgbGliZXJvIHNpdCBhbWV0IGVzdCBiaWJlbmR1bQogICAgICAg IHJob25jdXMuIEFlbmVhbiBmYWNpbGlzaXMgZXJvcyBpZCBuaXNpIGxhb3JlZXQgYSBtb2xsaXMg bGVvIHJ1dHJ1bS4gVmVzdGlidWx1bQogICAgICAgIGhlbmRyZXJpdCBzb2xsaWNpdHVkaW4gcG9y dGEuIFBlbGxlbnRlc3F1ZSBhdWN0b3IgbWkgY29uc2VxdWF0IG1hZ25hIGVnZXN0YXMKICAgICAg ICBwb3N1ZXJlLiBQcm9pbiBldSBpcHN1bSBtZXR1cy4gUGhhc2VsbHVzIGFsaXF1ZXQgZG9sb3Ig aW4gbnVuYyBhY2N1bXNhbiBwb3J0YS4KICAgICAgICBRdWlzcXVlIG5vbiBxdWFtIHNpdCBhbWV0 IGp1c3RvIGVsZW1lbnR1bSB2ZWhpY3VsYS4gSW4gaGFjIGhhYml0YXNzZSBwbGF0ZWEKICAgICAg ICBkaWN0dW1zdC4gRHVpcyB0ZW1wb3IgZmVsaXMgc2VkIGxhY3VzIGxhb3JlZXQgdGluY2lkdW50 LiBVdCBzaXQgYW1ldCBsb3JlbSBhdAogICAgICAgIG51bmMgb3JuYXJlIHNlbXBlciBldSBlZ2V0 IGVyYXQuIFBoYXNlbGx1cyB0dXJwaXMgZXN0LCBlbGVpZmVuZCBhdCBtYXR0aXMgcXVpcywKICAg ICAgICBmZXJtZW50dW0gZXQgZG9sb3IuCiAgICAgIDwvZGl2PgogICAgPC9kaXY+CiAgPC9ib2R5 Pgo8L2h0bWw+Cg==