New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 697320 link

Starred by 2 users
Status: WontFix
Owner:
█ msten...@opera.com
NOT IN USE
Closed: Jun 2017
Cc:
█ msrchandra@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

minSpaceShortage != LayoutUnit::max() in MultiColumnFragmentainerGroup.cpp

Project Member Reported by ClusterFuzz, Mar 1 2017 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6588385096630272

Fuzzer: mbarbella_js_mutation_layout
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  minSpaceShortage != LayoutUnit::max() in MultiColumnFragmentainerGroup.cpp
  blink::MultiColumnFragmentainerGroup::rebalanceColumnHeightIfNeeded
  blink::MultiColumnFragmentainerGroup::recalculateColumnHeight
  
Sanitizer: address (ASAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=387541:387557

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv95vQBuCgCxqxLh57J3UTVYYXWXnl9Ikd5up6aUrVetDVYMQCc9ZHhzwzaKzv6XJ6aHIYy5kuK6WUD0K7JJ8ISHpOqCmbYDVz6er8oj-iqnIwfJcpekLzbN6fqxdPEPdlQObc_2wPOpIz8KZaEcTYntU7L1EN1c9JnPKiyLlArYe9M9i-8AAhUxwoOpnadGTKMbJ4tOWwNvYNwokKb_lFWxgE8BhuB_cSKOEhliKkn3qxEyCKKeaLST-BgVCdHwREzG9qw3fHhSSHq5GXsKs6qBTOiBsBx2CjtGkHa9-7l984iydGcGSEFWMhZN0CnrNDOZU27q_CJ5w3aKY6iGNq7Gkqap5TBDFINvZwQvCnQVvBuiOY7fQT_5ccbjEREbT_TJf5bDNN_mGqSxEXYFQ39MYHTJ8xw?testcase_id=6588385096630272


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by msrchandra@chromium.org, Mar 1 2017

Cc: msrchandra@chromium.org
Labels: Test-Predator-Wrong M-58
Owner: msten...@opera.com
Status: Assigned (was: Untriaged)
Predator and CL did not provide any possible suspects.
Using Code Search for the file, "MultiColumnFragmentainerGroup.cpp" assigning to the concern owner.
Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/0b389da84405eef38ee9f9e54f51352a6c1508f3

@mstensho -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 2 by msten...@opera.com, Mar 1 2017 

That commit isn't even in the regression range, but sure, this one is mine. :)

I can reproduce it.

Comment 3 by msten...@opera.com, Mar 20 2017

Components: Blink>Layout>MultiCol

Comment 4 by msten...@opera.com, Apr 6 2017

tc.html
271 bytes View Download

Comment 5 by msten...@opera.com, Apr 6 2017 

Something seems to be completely broken regarding rebalancing an inner multicol container that has a forced break that triggers creation of a new row.

Attaching a test. This doesn't trigger any assertion failures, but I have a feeling that the root cause is the same.
multicol-with-forced-break-into-new-row.html
321 bytes View Download

Comment 6 by e...@chromium.org, Apr 18 2017

Labels: -Pri-1 Pri-2
Project Member

Comment 7 by ClusterFuzz, Jun 10 2017

Status: WontFix (was: Assigned)
ClusterFuzz testcase 6588385096630272 is flaky and no longer reproduces, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
►

Sign in to add a comment