[Webkit-unassigned] [Bug 116217] New: [CSSRegions] Assertion when cleaning-up RenderBoxRegionInfo objects after using negative margin-top to push the box into a previous region

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=116217

           Summary: [CSSRegions] Assertion when cleaning-up
                    RenderBoxRegionInfo objects after using negative
                    margin-top to push the box into a previous region
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: CSS
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: stavila at adobe.com


Created an attachment (id=201941)
 --> (https://bugs.webkit.org/attachment.cgi?id=201941&action=review)
File that reproduces the problem

When content is flowed into multiple regions, taking a box which would normally flow in the 3rd region and using a negative margin-top on it to push it back to the first would cause an assertion when cleaning-up (and a memory leak on release build). 

The problem seems to be that a RenderBoxRegionInfo object is generated for this box in the first region but, when calling RenderFlowThread::removeRenderBoxRegionInfo (RenderBox* box), it only destroys RenderBoxRegionInfo objects for the regions returned by the RenderFlowThread::getRegionRangeForBox method, which only returns regions 2 and 3, not taking into account that the negative margin-top pushed the box into a different region.

Attached test that reproduces the problem. Remove the following line to see what the page looks like without it crashing:

document.getElementById("divMain").style.display = "none";

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.