[Webkit-unassigned] [Bug 206106] Null Ptr Deref READ @ WebCore::RenderMultiColumnFlow::lastMultiColumnSet const

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=206106

--- Comment #5 from Jack <shihchieh_lee at apple.com> ---
Alan also verified with setting multi-column to 2 then 1 to make sure an element will be correctly attached back to multi-column container when RenderMultiColumnFlowThread is detached.

Below is the html to verify RenderMultiColumnFlowThread attach/detach:
<div id = container>
<div>foo</div>
<div>bar</div>
</div>
<script>
    container.style.webkitColumnCount = "2";
    setTimeout(function() {
              container.style.webkitColumnCount = "1";
              }, 5000);
</script>

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200124/f0d1330b/attachment.htm>