Bug 9806 – REGRESSION: Large rowspan causes WebKit to call abort()

• Status: RESOLVED
• Resolution: FIXED
• Component: Tables

A table with a large rowspan crashes WebKit. The test case is simply <TABLE><TD ROWSPAN=674227123>. This bug was found using the cgi-script at http://lcamtuf.coredump.cx/mangleme/mangle.cgi , found in the sidebar at http://browserfun.blogspot.com/ .

Looking through the nightlies, this crash doesn't occur before and including revision 14807.

Created attachment 9295 [details]
Test case (will crash!)

I forgot to say that the crash reporter isn't invoked, so there is no crash log to attach. WebKit simply quits.

[Alexey Proskuryakov]

Stack trace (from gdb):

#1  0x9012dfb4 in abort ()
#2  0x01cdbb7c in WTF::VectorBuffer<WebCore::RenderTableSection::RowStruct, 0ul>::allocateBuffer (this=0x18a31c50, newCapacity=674227123) at /Users/ap/WebKit/WebKitBuild/Debug/JavaScriptCore.framework/PrivateHeaders/Vector.h:251
#3  0x01cdbd20 in WTF::Vector<WebCore::RenderTableSection::RowStruct, 0ul>::reserveCapacity (this=0x18a31c4c, newCapacity=674227123) at /Users/ap/WebKit/WebKitBuild/Debug/JavaScriptCore.framework/PrivateHeaders/Vector.h:536
#4  0x01cdbde8 in WTF::Vector<WebCore::RenderTableSection::RowStruct, 0ul>::expandCapacity (this=0x18a31c4c, newMinCapacity=674227123) at /Users/ap/WebKit/WebKitBuild/Debug/JavaScriptCore.framework/PrivateHeaders/Vector.h:493
#5  0x01cdbe90 in WTF::Vector<WebCore::RenderTableSection::RowStruct, 0ul>::resize (this=0x18a31c4c, size=674227123) at /Users/ap/WebKit/WebKitBuild/Debug/JavaScriptCore.framework/PrivateHeaders/Vector.h:522
#6  0x01a07788 in WebCore::RenderTableSection::ensureRows (this=0x18a31bec, numRows=674227123) at /Users/ap/WebKit/WebCore/rendering/RenderTableSection.cpp:150

BTW, we have mangleme and iExploder tests in WebKitTools/Scripts: run-mangleme-tests and run-iexploder-tests,

[Darin Adler]

I'm sure mangleme can find another problem with rowspans, since all this does is prevent the abort that checks for numeric overflow.

[Darin Adler]

Created attachment 9350 [details]
patch, including change log and a layout test

[Alice Liu]

<rdar://problem/4622622>

[Maciej Stachowiak]

Comment on attachment 9350 [details]
patch, including change log and a layout test

r=me

[Darin Adler]

Committed revision 15390.

[David Kilzer (:ddkilzer)]

Also committed revision 15392 to fix LayoutTest files with property information in them.  (See Bug 9875.)