Not sure if it's important enough to fix. This is an edge case that will never occur in real situations, but taking minutes to lay out a page isn't that good, either...

When loading the attached test case, it churns for a couple of minutes, and then:

ASSERTION FAILED: count <= kGenericMaxDirectMapped / sizeof(T)
../../third_party/WebKit/Source/wtf/allocator/PartitionAllocator.h(58) : static size_t WTF::PartitionAllocator::quantizedSize(size_t) [T = blink::MultiColumnFragmentainerGroup]
1   0x7fffea38ad03
2   0x7fffea38ac99
3   0x7fffea38add5
4   0x7fffea38aba3
5   0x7fffea38aac4
6   0x7fffea38aa38
7   0x7fffea38a934
8   0x7fffea38a8c5
9   0x7fffea38a7f4
10  0x7fffea38a71d
11  0x7fffea38a27c
12  0x7fffea3889b7 blink::LayoutMultiColumnSet::appendNewFragmentainerGroup()
13  0x7fffea384023 blink::LayoutMultiColumnFlowThread::appendNewFragmentainerGroupIfNeeded(blink::LayoutUnit, blink::LayoutBox::PageBoundaryRule)
14  0x7fffea383c4b blink::LayoutMultiColumnFlowThread::layoutColumns(blink::SubtreeLayoutScope&)
15  0x7fffea2b6ac6 blink::LayoutBlockFlow::layoutSpecialExcludedChild(bool, blink::SubtreeLayoutScope&)
16  0x7fffea2bd442 blink::LayoutBlockFlow::layoutBlockChildren(bool, blink::SubtreeLayoutScope&, blink::LayoutUnit, blink::LayoutUnit)
17  0x7fffea2c9232
18  0x7fffea2b7b09 blink::LayoutBlockFlow::layoutBlock(bool)
19  0x7fffea2a3bb9 blink::LayoutBlock::layout()

The reason is that we create an insane number of column rows, because the outer multicol container is very short. We use a Vector to store the column rows (MultiColumnFragmentainerGroup objects). Building a huge array takes a lot of time and memory.

The test case is taken from bug 583713.
 

Deleted: tc.html 254 bytes

tc.html 254 bytes View Download