Through code search on file LayoutGeometryMap.cpp, suspected CL is 
https://chromium.googlesource.com/chromium/src/+/78b26d84270257a830facd6477ef6e3ff59aca66%5E%21/#F3
wangxianzhu@, could you please take a look?
Thank you

It seems that the transform on the multicol is not respected when pushing mapping into LayoutGeometryMap.

mstensho@opera.com, can you take a look?

Pretty obvious what's going wrong here, but I'm not sure where it should be fixed.

#3  0x00007fffea044366 in blink::LayoutGeometryMap::MapToAncestor (this=0x7fffb5a66600, rect=..., ancestor=0x0)
    at gen/third_party/WebKit/Source/core/layout/../../../../../../../../third_party/WebKit/Source/core/layout/LayoutGeometryMap.cpp:189
#4  0x00007fffea0c5829 in blink::LayoutGeometryMap::AbsoluteRect (this=0x7fffb5a66600, rect=...)
    at ../../third_party/WebKit/Source/core/layout/LayoutGeometryMap.h:61
#5  0x00007fffea057926 in blink::(anonymous namespace)::AbsoluteQuadsGeneratorContext::operator() (this=0x7fffb5a665f8, rect=...)
    at gen/third_party/WebKit/Source/core/layout/../../../../../../../../third_party/WebKit/Source/core/layout/LayoutInline.cpp:780
#6  0x00007fffea089c55 in blink::(anonymous namespace)::AbsoluteQuadsGeneratorContext::operator() (this=0x7fffb5a665f8, rect=...)
    at gen/third_party/WebKit/Source/core/layout/../../../../../../../../third_party/WebKit/Source/core/layout/LayoutInline.cpp:782
#7  0x00007fffea089b42 in blink::LayoutInline::GenerateCulledLineBoxRects<blink::(anonymous namespace)::AbsoluteQuadsGeneratorContext> (this=0x3e375963c010, yield=..., container=0x3e375963c010)
    at gen/third_party/WebKit/Source/core/layout/../../../../../../../../third_party/WebKit/Source/core/layout/LayoutInline.cpp:714
#8  0x00007fffea057859 in blink::LayoutInline::GenerateLineBoxRects<blink::(anonymous namespace)::AbsoluteQuadsGeneratorContext>
    (this=0x3e375963c010, yield=...)
    at gen/third_party/WebKit/Source/core/layout/../../../../../../../../third_party/WebKit/Source/core/layout/LayoutInline.cpp:616
#9  0x00007fffea057750 in blink::LayoutInline::AbsoluteQuadsForSelf (this=0x3e375963c010, 
    quads=WTF::Vector of length 0, capacity 0, mode=0)
    at gen/third_party/WebKit/Source/core/layout/../../../../../../../../third_party/WebKit/Source/core/layout/LayoutInline.cpp:794
#10 0x00007fffea01fd36 in blink::LayoutBoxModelObject::AbsoluteQuads (this=0x3e375963c010, 
    quads=WTF::Vector of length 0, capacity 0, mode=0)
    at gen/third_party/WebKit/Source/core/layout/../../../../../../../../third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp:695
#11 0x00007fffe965bb28 in blink::Element::ClientQuads (this=0x28fa75063b70, quads=WTF::Vector of length 0, capacity 0)
    at gen/third_party/WebKit/Source/core/dom/../../../../../../../../third_party/WebKit/Source/core/dom/Element.cpp:1240

Element::ClientQuads() doesn't specify the mode parameter, so we get no flags set. No kUseTransforms, nothing. I don't know if this is correct.

Anyway, MapToAncestor() in frame #3 invokes the other MapToAncestor() method (TransformState&, const LayoutBoxModelObject* ancestor), which realizes that we HasNonUniformStep(), and MapLocalToAncestor() calls on its own, without adding any other flag than kApplyContainerFlip. |ancestor| is nullptr, so we walk all the way to the root, which is fine.

The test code, that DCHECKs if the result is sane, calls LayoutObject::LocalToAncestorQuad(), which supplies kUseTransforms. MapLocalToAncestor(), on the other hand, doesn't supply anything.

So, how should we make sure that kUseTransforms is included? Should we perhaps call LocalToAncestorQuad() instead of MapLocalToAncestor() directly? The MapLocalToAncestor() documentation mentions that "[y]ou should never need to call these directly; use localToAbsolute/ absoluteToLocal methods instead.". :)

Deleted: tc.html 252 bytes

tc.html 252 bytes View Download

+chrishtr for idea about #3.

You should add kUseTransforms to the call to AbsoluteQuads from 
Element::ClientQuads. Transform is already included for boxes, since
LayoutBox::AbsoluteQuads calls LayoutBox::LocalToAncestorQuad, which
adds kUseTransforms as you mentioned.

Thanks, I'll try that.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5f519ec9467adf9c3073628e9b8eac7e5a6d87ea

commit 5f519ec9467adf9c3073628e9b8eac7e5a6d87ea
Author: Morten Stenshorne <mstensho@opera.com>
Date: Wed Jun 21 00:12:38 2017

Element::ClientQuads() needs to take transforms into account.

In LayoutGeometryMap, when there's a non-uniform step (e.g. when inside
multicol), we fall back on doing it the slow way, i.e. we involve
LayoutObject::MapLocalToAncestor(). The mode flags initially passed from
ClientQuads() will just be echoed here, so we need to make sure that
kUseTransforms is specified.

BUG= 683925 

Change-Id: I2a6fe83fb1332a19a581203d6c44c6924da3f027
Reviewed-on: https://chromium-review.googlesource.com/541339
Reviewed-by: Chris harrelson <chrishtr@chromium.org>
Commit-Queue: Morten Stenshorne <mstensho@opera.com>
Cr-Commit-Position: refs/heads/master@{#481039}
[add] https://crrev.com/5f519ec9467adf9c3073628e9b8eac7e5a6d87ea/third_party/WebKit/LayoutTests/transforms/inline-in-transformed-multicol.html
[add] https://crrev.com/5f519ec9467adf9c3073628e9b8eac7e5a6d87ea/third_party/WebKit/LayoutTests/transforms/transformed-inline-block-in-multicol.html
[modify] https://crrev.com/5f519ec9467adf9c3073628e9b8eac7e5a6d87ea/third_party/WebKit/Source/core/dom/Element.cpp

ClusterFuzz has detected this issue as fixed in range 481038:481050.

Detailed report: https://clusterfuzz.com/testcase?key=6500833010384896

Fuzzer: mbarbella_js_mutation_layout
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  enclosingIntRect(layoutObjectMappedResult) == enclosingIntRect(result.boundingBo
  blink::LayoutGeometryMap::mapToAncestor
  blink::LayoutGeometryMap::absoluteRect
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_debug_content_shell_drt&range=443258:443393
Fixed: https://clusterfuzz.com/revisions?job=linux_debug_content_shell_drt&range=481038:481050

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6500833010384896


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.