| Summary: | [css-multicol] OOM with 1px height columns | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Ryosuke Niwa <rniwa> | ||||||||||
| Component: | Layout and Rendering | Assignee: | Nobody <webkit-unassigned> | ||||||||||
| Status: | REOPENED --- | ||||||||||||
| Severity: | Normal | CC: | bfulgham, cgarcia, commit-queue, ews-feeder, fred.wang, gpoo, koivisto, rbuis, simon.fraser, svillar, webkit-bug-importer, zalan | ||||||||||
| Priority: | P2 | Keywords: | InRadar | ||||||||||
| Version: | WebKit Nightly Build | ||||||||||||
| Hardware: | Unspecified | ||||||||||||
| OS: | Unspecified | ||||||||||||
| See Also: | https://bugs.webkit.org/show_bug.cgi?id=221962 | ||||||||||||
| Bug Depends on: | 224908 | ||||||||||||
| Bug Blocks: | |||||||||||||
| Attachments: |
|
||||||||||||
|
Description
Ryosuke Niwa
2021-01-08 17:43:21 PST
Created attachment 417523 [details]
Even smaller test case
It crashes for me even without the webkit-line stuff.
It seems it's crashing due to an OOM situation caused by excesive allocations in a Vector of layer fragments. I've debugged a bit the issue and it looks like the problem is that the multicolumn code thinks that there are 10693 columns and thus create a layer fragment for each eventually making allocations fail. Will provide more info as available. (In reply to Sergio Villar Senin from comment #2) > It seems it's crashing due to an OOM situation caused by excesive > allocations in a Vector of layer fragments. I've debugged a bit the issue > and it looks like the problem is that the multicolumn code thinks that there > are 10693 columns and thus create a layer fragment for each eventually > making allocations fail. LOL. That's hilarious. How is that possible given the document is basically empty? (In reply to Ryosuke Niwa from comment #3) > (In reply to Sergio Villar Senin from comment #2) > > It seems it's crashing due to an OOM situation caused by excesive > > allocations in a Vector of layer fragments. I've debugged a bit the issue > > and it looks like the problem is that the multicolumn code thinks that there > > are 10693 columns and thus create a layer fragment for each eventually > > making allocations fail. > > LOL. That's hilarious. How is that possible given the document is basically > empty? That's why I'm figuring out ATM. We might be doing something wrong with overflows. Check out the overflow values for the top renderers: B---YGL- --* RenderView at (0,0) size 1024x730 renderer->(0x6160002bcb80) (layout overflow 0,0 181782x730) B-----L- -- HTML RenderBlock at (0,0) size 1x730 renderer->(0x612000366f40) node->(0x60c0002b63c0) (layout overflow 0,0 181782x730) (visual overflow 0,0 181782x730) B---YGL- -- RenderMultiColumnFlowThread at (0,0) size 2x730 renderer->(0x615000286e80) (layout overflow 0,0 10694x730) (visual overflow 0,0 10694x730) [Rs:0x6140000a4e40 Re:0x6140000a4e40] B-----L- -- HEAD RenderBlock at (0,0) size 1x730 renderer->(0x6120003670c0) node->(0x60c0002b6480) (layout overflow 0,0 10694x730) (visual overflow 0,0 10694x730) [Rs:0x6140000a4e40 Re:0x6140000a4e40] B---YGL- -- RenderMultiColumnFlowThread at (0,0) size 1x730 renderer->(0x615000286c00) (layout overflow 0,0 630x730) (visual overflow 0,0 630x730) [Rs:0x6140000a4c40 Re:0x6140000a4c40] Hm... maybe things are messed with vertical writing mode & columns? Created attachment 417834 [details]
Patch
I've attached a patch with test case because I think we could consider this as non-security issue. Created attachment 417862 [details]
Patch
Committed r271644: <https://trac.webkit.org/changeset/271644> This has caused bug 221962 Re-opened since this is blocked by bug 224908 |