100465 2012-10-25 22:45:13 -0700 Crash in flexbox when removing absolutely positioned children 2012-11-14 15:36:42 -0800 1 1 1 Unclassified WebKit MathML 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 62048 1 inferno tony dbarton eric fred.wang ojan tony webkit.review.bot oldest_to_newest 751560 0 170818 inferno 2012-10-25 22:45:13 -0700 Created attachment 170818 Testcase - 3 ==28198== ERROR: AddressSanitizer crashed on unknown address 0x000000000034 (pc 0x7fb6494d914b sp 0x7fff6f9185e0 bp 0x7fff6f9186b0 T0) AddressSanitizer can not provide additional info. #0 0x7fb6494d914a in WebCore::RenderObject::RenderObjectBitfields::positioned() const third_party/WebKit/Source/WebCore/rendering/RenderObject.h:1053 #1 0x7fb6494d8ff0 in WebCore::RenderObject::isOutOfFlowPositioned() const third_party/WebKit/Source/WebCore/rendering/RenderObject.h:529 #2 0x7fb64ffae5a7 in WebCore::RenderFlexibleBox::firstLineBoxBaseline() const third_party/WebKit/Source/WebCore/rendering/RenderFlexibleBox.cpp:258 #3 0x7fb64ffaeb89 in WebCore::RenderFlexibleBox::firstLineBoxBaseline() const third_party/WebKit/Source/WebCore/rendering/RenderFlexibleBox.cpp:276 #4 0x7fb65072f061 in WebCore::RenderMathMLBlock::baselinePosition(WebCore::FontBaseline, bool, WebCore::LineDirectionMode, WebCore::LinePositionMode) const third_party/WebKit/Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp:208 #5 0x7fb64fa27425 in WebCore::InlineBox::baselinePosition(WebCore::FontBaseline) const third_party/WebKit/Source/WebCore/rendering/InlineBox.cpp:164 #6 0x7fb6506f3478 in WebCore::RootInlineBox::ascentAndDescentForBox(WebCore::InlineBox*, WTF::HashMap<WebCore::InlineTextBox const*, std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow>, WTF::PtrHash<WebCore::InlineTextBox const*>, WTF::HashTraits<WebCore::InlineTextBox const*>, WTF::HashTraits<std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow> > >&, int&, int&, bool&, bool&) const third_party/WebKit/Source/WebCore/rendering/RootInlineBox.cpp:744 #7 0x7fb64fa3f744 in WebCore::InlineFlowBox::computeLogicalBoxHeights(WebCore::RootInlineBox*, WebCore::FractionalLayoutUnit&, WebCore::FractionalLayoutUnit&, WebCore::FractionalLayoutUnit&, WebCore::FractionalLayoutUnit&, bool&, bool&, bool, WTF::HashMap<WebCore::InlineTextBox const*, std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow>, WTF::PtrHash<WebCore::InlineTextBox const*>, WTF::HashTraits<WebCore::InlineTextBox const*>, WTF::HashTraits<std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow> > >&, WebCore::FontBaseline, WebCore::VerticalPositionCache&) third_party/WebKit/Source/WebCore/rendering/InlineFlowBox.cpp:565 #8 0x7fb6506e75cc in WebCore::RootInlineBox::alignBoxesInBlockDirection(WebCore::FractionalLayoutUnit, WTF::HashMap<WebCore::InlineTextBox const*, std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow>, WTF::PtrHash<WebCore::InlineTextBox const*>, WTF::HashTraits<WebCore::InlineTextBox const*>, WTF::HashTraits<std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow> > >&, WebCore::VerticalPositionCache&) third_party/WebKit/Source/WebCore/rendering/RootInlineBox.cpp:275 #9 0x7fb64fd117ba in WebCore::RenderBlock::computeBlockDirectionPositionsForLine(WebCore::RootInlineBox*, WebCore::BidiRun*, WTF::HashMap<WebCore::InlineTextBox const*, std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow>, WTF::PtrHash<WebCore::InlineTextBox const*>, WTF::HashTraits<WebCore::InlineTextBox const*>, WTF::HashTraits<std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow> > >&, WebCore::VerticalPositionCache&) third_party/WebKit/Source/WebCore/rendering/RenderBlockLineLayout.cpp:966 #10 0x7fb64fd1304b in WebCore::RenderBlock::createLineBoxesFromBidiRuns(WebCore::BidiRunList<WebCore::BidiRun>&, WebCore::InlineIterator const&, WebCore::LineInfo&, WebCore::VerticalPositionCache&, WebCore::BidiRun*, WTF::Vector<WebCore::WordMeasurement, 64ul>&) third_party/WebKit/Source/WebCore/rendering/RenderBlockLineLayout.cpp:1198 #11 0x7fb64fd1c7f1 in WebCore::RenderBlock::layoutRunsAndFloatsInRange(WebCore::LineLayoutState&, WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>&, WebCore::InlineIterator const&, WebCore::BidiStatus const&, unsigned int) third_party/WebKit/Source/WebCore/rendering/RenderBlockLineLayout.cpp:1484 #12 0x7fb64fd1482e in WebCore::RenderBlock::layoutRunsAndFloats(WebCore::LineLayoutState&, bool) third_party/WebKit/Source/WebCore/rendering/RenderBlockLineLayout.cpp:1372 #13 0x7fb64fd3afa1 in WebCore::RenderBlock::layoutInlineChildren(bool, WebCore::FractionalLayoutUnit&, WebCore::FractionalLayoutUnit&) third_party/WebKit/Source/WebCore/rendering/RenderBlockLineLayout.cpp:1714 #14 0x7fb64fb12315 in WebCore::RenderBlock::layoutBlock(bool, WebCore::FractionalLayoutUnit) third_party/WebKit/Source/WebCore/rendering/RenderBlock.cpp:1555 #15 0x7fb64fb0debd in WebCore::RenderBlock::layout() third_party/WebKit/Source/WebCore/rendering/RenderBlock.cpp:1383 #16 0x7fb64fb42677 in WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, WebCore::FractionalLayoutUnit&, WebCore::FractionalLayoutUnit&) third_party/WebKit/Source/WebCore/rendering/RenderBlock.cpp:2485 #17 0x7fb64fb1b0cf in WebCore::RenderBlock::layoutBlockChildren(bool, WebCore::FractionalLayoutUnit&) third_party/WebKit/Source/WebCore/rendering/RenderBlock.cpp:2421 #18 0x7fb64fb12396 in WebCore::RenderBlock::layoutBlock(bool, WebCore::FractionalLayoutUnit) third_party/WebKit/Source/WebCore/rendering/RenderBlock.cpp:1557 #19 0x7fb64fb0debd in WebCore::RenderBlock::layout() third_party/WebKit/Source/WebCore/rendering/RenderBlock.cpp:1383 #20 0x7fb64fb42677 in WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, WebCore::FractionalLayoutUnit&, WebCore::FractionalLayoutUnit&) third_party/WebKit/Source/WebCore/rendering/RenderBlock.cpp:2485 #21 0x7fb64fb1b0cf in WebCore::RenderBlock::layoutBlockChildren(bool, WebCore::FractionalLayoutUnit&) third_party/WebKit/Source/WebCore/rendering/RenderBlock.cpp:2421 #22 0x7fb64fb12396 in WebCore::RenderBlock::layoutBlock(bool, WebCore::FractionalLayoutUnit) third_party/WebKit/Source/WebCore/rendering/RenderBlock.cpp:1557 #23 0x7fb64fb0debd in WebCore::RenderBlock::layout() third_party/WebKit/Source/WebCore/rendering/RenderBlock.cpp:1383 #24 0x7fb65064d64e in WebCore::RenderView::layoutContent(WebCore::LayoutState const&) third_party/WebKit/Source/WebCore/rendering/RenderView.cpp:140 #25 0x7fb65064f5e2 in WebCore::RenderView::layout() third_party/WebKit/Source/WebCore/rendering/RenderView.cpp:197 #26 0x7fb64f1d5590 in WebCore::FrameView::layout(bool) third_party/WebKit/Source/WebCore/page/FrameView.cpp:1191 #27 0x7fb64f1bf5a8 in WebCore::FrameView::layoutTimerFired(WebCore::Timer<WebCore::FrameView>*) third_party/WebKit/Source/WebCore/page/FrameView.cpp:2129 #28 0x7fb64f25b494 in WebCore::Timer<WebCore::FrameView>::fired() third_party/WebKit/Source/WebCore/platform/Timer.h:106 #29 0x7fb64b06d5e6 in WebCore::ThreadTimers::sharedTimerFiredInternal() third_party/WebKit/Source/WebCore/platform/ThreadTimers.cpp:116 #30 0x7fb64b06c8a8 in WebCore::ThreadTimers::sharedTimerFired() third_party/WebKit/Source/WebCore/platform/ThreadTimers.cpp:93 #31 0x7fb65cdeb0dc in webkit_glue::WebKitPlatformSupportImpl::DoTimeout() ./webkit/glue/webkitplatformsupport_impl.h:165 #32 0x7fb65cdf357f in base::internal::RunnableAdapter<void (webkit_glue::WebKitPlatformSupportImpl::*)()>::Run(webkit_glue::WebKitPlatformSupportImpl*) ./base/bind_internal.h:134 #33 0x7fb65cdf31ca in base::internal::InvokeHelper<false, void, base::internal::RunnableAdapter<void (webkit_glue::WebKitPlatformSupportImpl::*)()>, void (webkit_glue::WebKitPlatformSupportImpl*)>::MakeItSo(base::internal::RunnableAdapter<void (webkit_glue::WebKitPlatformSupportImpl::*)()>, webkit_glue::WebKitPlatformSupportImpl*) ./base/bind_internal.h:870 #34 0x7fb65cdf2ed7 in base::internal::Invoker<1, base::internal::BindState<base::internal::RunnableAdapter<void (webkit_glue::WebKitPlatformSupportImpl::*)()>, void (webkit_glue::WebKitPlatformSupportImpl*), void (base::internal::UnretainedWrapper<webkit_glue::WebKitPlatformSupportImpl>)>, void (webkit_glue::WebKitPlatformSupportImpl*)>::Run(base::internal::BindStateBase*) ./base/bind_internal.h:1172 #35 0x7fb6749c151c in base::Callback<void ()>::Run() const ./base/callback.h:391 #36 0x7fb67500e03b in base::Timer::RunScheduledTask() base/timer.cc:181 #37 0x7fb67500e9f0 in base::BaseTimerTaskInternal::Run() base/timer.cc:46 #38 0x7fb67501154f in base::internal::RunnableAdapter<void (base::BaseTimerTaskInternal::*)()>::Run(base::BaseTimerTaskInternal*) ./base/bind_internal.h:134 #39 0x7fb67501119a in base::internal::InvokeHelper<false, void, base::internal::RunnableAdapter<void (base::BaseTimerTaskInternal::*)()>, void (base::BaseTimerTaskInternal*)>::MakeItSo(base::internal::RunnableAdapter<void (base::BaseTimerTaskInternal::*)()>, base::BaseTimerTaskInternal*) ./base/bind_internal.h:870 #40 0x7fb675010e93 in base::internal::Invoker<1, base::internal::BindState<base::internal::RunnableAdapter<void (base::BaseTimerTaskInternal::*)()>, void (base::BaseTimerTaskInternal*), void (base::internal::OwnedWrapper<base::BaseTimerTaskInternal>)>, void (base::BaseTimerTaskInternal*)>::Run(base::internal::BindStateBase*) ./base/bind_internal.h:1172 #41 0x7fb6749c151c in base::Callback<void ()>::Run() const ./base/callback.h:391 #42 0x7fb674bdd59d in MessageLoop::RunTask(base::PendingTask const&) base/message_loop.cc:470 #43 0x7fb674bdf40a in MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop.cc:482 #44 0x7fb674bdfac5 in MessageLoop::DoWork() base/message_loop.cc:661 #45 0x7fb674c3171b in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_pump_default.cc:28 #46 0x7fb674bdb7c9 in MessageLoop::RunInternal() base/message_loop.cc:427 #47 0x7fb674bdb256 in MessageLoop::RunHandler() base/message_loop.cc:400 #48 0x7fb674da6d21 in base::RunLoop::Run() base/run_loop.cc:45 #49 0x7fb674bd8eda in MessageLoop::Run() base/message_loop.cc:307 #50 0x7fb666721691 in RendererMain(content::MainFunctionParams const&) content/renderer/renderer_main.cc:239 #51 0x7fb6630204d9 in content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:402 #52 0x7fb6630216ed in content::RunNamedProcessTypeMain(std::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:456 #53 0x7fb663026a3b in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:741 #54 0x7fb66301df3d in content::ContentMain(int, char const**, content::ContentMainDelegate*) content/app/content_main.cc:35 #55 0x7fb675f43a5d in ChromeMain chrome/app/chrome_main.cc:32 #56 0x7fb675f4372a in main chrome/app/chrome_exe_main_gtk.cc:31 #57 0x7fb635fc976c in __libc_start_main /build/buildd/eglibc-2.15/csu/libc-start.c:226 Stats: 6M malloced (33M for red zones) by 33079 calls Stats: 0M realloced by 88 calls Stats: 4M freed by 15527 calls Stats: 0M really freed by 0 calls Stats: 42M (10899 full pages) mmaped in 85 calls mmaps by size class: 10:32193; 11:765; 12:256; 13:128; 14:160; 15:48; 16:16; 17:12; 18:2; 19:1; mallocs by size class: 10:32057; 11:568; 12:183; 13:77; 14:129; 15:40; 16:12; 17:10; 18:2; 19:1; frees by size class: 10:14772; 11:460; 12:71; 13:63; 14:114; 15:33; 16:6; 17:6; 18:1; 19:1; rfrees by size class: Stats: malloc large: 65 small slow: 1150 ==28198== ABORTING 751568 1 eric 2012-10-25 22:57:22 -0700 More likely to be a flexbox bug than a MathML one. It also looks like this code may have changed since this bug was found. http://trac.webkit.org/browser/trunk/Source/WebCore/rendering/RenderFlexibleBox.cpp 751582 2 eric 2012-10-25 23:15:08 -0700 This managed to crash my release build from earlier today. I've not yet tried it in debug. So even though the stack doesn't seem to match the current code, this still seems to be a crasher. 751585 3 eric 2012-10-25 23:17:31 -0700 Here is a crash stack from my build: Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000030 Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x000000010fa9dffd WebCore::RenderFlexibleBox::firstLineBoxBaseline() const + 429 (RenderObject.h:1065) 1 com.apple.WebCore 0x000000010fa9e159 WebCore::RenderFlexibleBox::firstLineBoxBaseline() const + 777 (RenderFlexibleBox.cpp:280) 2 com.apple.WebCore 0x000000010fae3b41 WebCore::RenderMathMLBlock::baselinePosition(WebCore::FontBaseline, bool, WebCore::LineDirectionMode, WebCore::LinePositionMode) const + 49 (RenderMathMLBlock.cpp:208) 3 com.apple.WebCore 0x000000010fbabc79 WebCore::RootInlineBox::ascentAndDescentForBox(WebCore::InlineBox*, WTF::HashMap<WebCore::InlineTextBox const*, std::__1::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow>, WTF::PtrHash<WebCore::InlineTextBox const*>, WTF::HashTraits<WebCore::InlineTextBox const*>, WTF::HashTraits<std::__1::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow> > >&, int&, int&, bool&, bool&) const + 169 (RootInlineBox.cpp:744) 4 com.apple.WebCore 0x000000010f597d38 WebCore::InlineFlowBox::computeLogicalBoxHeights(WebCore::RootInlineBox*, WebCore::FractionalLayoutUnit&, WebCore::FractionalLayoutUnit&, int&, int&, bool&, bool&, bool, WTF::HashMap<WebCore::InlineTextBox const*, std::__1::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow>, WTF::PtrHash<WebCore::InlineTextBox const*>, WTF::HashTraits<WebCore::InlineTextBox const*>, WTF::HashTraits<std::__1::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow> > >&, WebCore::FontBaseline, WebCore::VerticalPositionCache&) + 680 (InlineBox.h:184) 5 com.apple.WebCore 0x000000010fbaa572 WebCore::RootInlineBox::alignBoxesInBlockDirection(WebCore::FractionalLayoutUnit, WTF::HashMap<WebCore::InlineTextBox const*, std::__1::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow>, WTF::PtrHash<WebCore::InlineTextBox const*>, WTF::HashTraits<WebCore::InlineTextBox const*>, WTF::HashTraits<std::__1::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow> > >&, WebCore::VerticalPositionCache&) + 242 (FractionalLayoutUnit.h:176) 6 com.apple.WebCore 0x000000010fa636bb WebCore::RenderBlock::computeBlockDirectionPositionsForLine(WebCore::RootInlineBox*, WebCore::BidiRun*, WTF::HashMap<WebCore::InlineTextBox const*, std::__1::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow>, WTF::PtrHash<WebCore::InlineTextBox const*>, WTF::HashTraits<WebCore::InlineTextBox const*>, WTF::HashTraits<std::__1::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow> > >&, WebCore::VerticalPositionCache&) + 75 (RefPtr.h:58) 7 com.apple.WebCore 0x000000010fa6387d WebCore::RenderBlock::createLineBoxesFromBidiRuns(WebCore::BidiRunList<WebCore::BidiRun>&, WebCore::InlineIterator const&, WebCore::LineInfo&, WebCore::VerticalPositionCache&, WebCore::BidiRun*, WTF::Vector<WebCore::WordMeasurement, 64ul>&) + 237 (RenderBlockLineLayout.cpp:1200) 8 com.apple.WebCore 0x000000010fa6583b WebCore::RenderBlock::layoutRunsAndFloatsInRange(WebCore::LineLayoutState&, WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>&, WebCore::InlineIterator const&, WebCore::BidiStatus const&, unsigned int) + 3979 (RenderBlockLineLayout.cpp:1485) 9 com.apple.WebCore 0x000000010fa63e3a WebCore::RenderBlock::layoutRunsAndFloats(WebCore::LineLayoutState&, bool) + 1242 (RenderBlockLineLayout.cpp:1375) 10 com.apple.WebCore 0x000000010fa6a6c1 WebCore::RenderBlock::layoutInlineChildren(bool, WebCore::FractionalLayoutUnit&, WebCore::FractionalLayoutUnit&) + 1281 (Vector.h:527) 11 com.apple.WebCore 0x000000010fa44e52 WebCore::RenderBlock::layoutBlock(bool, WebCore::FractionalLayoutUnit) + 1010 (RenderBlock.cpp:1554) 12 com.apple.WebCore 0x000000010fa44450 WebCore::RenderBlock::layout() + 64 (RenderBlock.cpp:1386) 13 com.apple.WebCore 0x000000010fa4b4d8 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, WebCore::FractionalLayoutUnit&, WebCore::FractionalLayoutUnit&) + 856 (RenderBlock.cpp:2484) 14 com.apple.WebCore 0x000000010fa4657a WebCore::RenderBlock::layoutBlockChildren(bool, WebCore::FractionalLayoutUnit&) + 586 (RenderBlock.cpp:2397) 15 com.apple.WebCore 0x000000010fa44e6c WebCore::RenderBlock::layoutBlock(bool, WebCore::FractionalLayoutUnit) + 1036 (RenderBlock.cpp:1559) 16 com.apple.WebCore 0x000000010fa44450 WebCore::RenderBlock::layout() + 64 (RenderBlock.cpp:1386) 17 com.apple.WebCore 0x000000010fa4b4d8 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, WebCore::FractionalLayoutUnit&, WebCore::FractionalLayoutUnit&) + 856 (RenderBlock.cpp:2484) 18 com.apple.WebCore 0x000000010fa4657a WebCore::RenderBlock::layoutBlockChildren(bool, WebCore::FractionalLayoutUnit&) + 586 (RenderBlock.cpp:2397) 19 com.apple.WebCore 0x000000010fa44e6c WebCore::RenderBlock::layoutBlock(bool, WebCore::FractionalLayoutUnit) + 1036 (RenderBlock.cpp:1559) 20 com.apple.WebCore 0x000000010fa44450 WebCore::RenderBlock::layout() + 64 (RenderBlock.cpp:1386) 21 com.apple.WebCore 0x000000010fb86245 WebCore::RenderView::layout() + 917 (OwnPtr.h:78) 22 com.apple.WebCore 0x000000010f479b95 WebCore::FrameView::layout(bool) + 1733 (FrameView.cpp:1197) 23 com.apple.WebCore 0x000000010f47f7cd WebCore::FrameView::updateLayoutAndStyleIfNeededRecursive() + 141 (HashTable.h:391) 24 com.apple.WebKit2 0x000000010e79d624 WebKit::WebPage::layoutIfNeeded() + 34 (RefPtr.h:70) 752172 4 170954 ojan 2012-10-26 10:42:23 -0700 Created attachment 170954 reduced testcase 752203 5 170964 ojan 2012-10-26 11:12:01 -0700 Created attachment 170964 more minimal test case It looks like when the input gets removed from the msubsup element, we're left with an anonymous flexbox inside the msubsup element. We try to get the baseline of the msubsup, and then try to get the baseline of the anonymous flexbox and crash because it has no firstChild, but did the last time we laid it out. 752206 6 ojan 2012-10-26 11:17:39 -0700 Looks like this is in fact a MathML issue. RenderMathMLSubSup::addChild creates wrappers, but doesn't remove them when the children are removed. I'll leave this in dbarton's hands. 752235 7 eric 2012-10-26 11:48:05 -0700 This may be fixed by bug 98791. 752681 8 171073 dbarton 2012-10-26 22:26:35 -0700 Created attachment 171073 Ojan's test case without MathML I like both Eric's and Ojan's analysis and reduced test cases (thanks!). However, I counter-argue and claim it's still a flexbox bug. :) Here's an attachment that seems to cause the same crash, just using <div> elements and -webkit-inline-flex like MathML (msubsup) uses them. My flexbox code may be a few days old, but here's my stack trace: crash log for DumpRenderTree (pid 99385): STDOUT: <empty> STDERR: [99385:-1603631808:383108477912945:ERROR:process_util_posix.cc(144)] Received signal 10 STDERR: 0 DumpRenderTree 0x5db65f2f base::debug::StackTrace::StackTrace() + 63 STDERR: 1 DumpRenderTree 0x5db65ecb base::debug::StackTrace::StackTrace() + 43 STDERR: 2 DumpRenderTree 0x5dc23487 base::(anonymous namespace)::StackDumpSignalHandler(int, __siginfo*, __darwin_ucontext*) + 295 STDERR: 3 libSystem.B.dylib 0x9588405b _sigtramp + 43 STDERR: 4 ??? 0xffffffff 0x0 + 4294967295 STDERR: 5 DumpRenderTree 0x6078dc12 WebCore::RenderObject::isOutOfFlowPositioned() const + 50 STDERR: 6 DumpRenderTree 0x608006e3 WebCore::RenderFlexibleBox::firstLineBoxBaseline() const + 275 STDERR: 7 DumpRenderTree 0x608008c5 WebCore::RenderFlexibleBox::firstLineBoxBaseline() const + 757 STDERR: 8 DumpRenderTree 0x6080039f WebCore::RenderFlexibleBox::baselinePosition(WebCore::FontBaseline, bool, WebCore::LineDirectionMode, WebCore::LinePositionMode) const + 79 STDERR: 9 DumpRenderTree 0x606a6f6d WebCore::InlineBox::baselinePosition(WebCore::FontBaseline) const + 173 STDERR: 10 DumpRenderTree 0x609d2de3 WebCore::RootInlineBox::ascentAndDescentForBox(WebCore::InlineBox*, WTF::HashMap<WebCore::InlineTextBox const*, std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow>, WTF::PtrHash<WebCore::InlineTextBox const*>, WTF::HashTraits<WebCore::InlineTextBox const*>, WTF::HashTraits<std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow> > >&, int&, int&, bool&, bool&) const + 307 STDERR: 11 DumpRenderTree 0x606abe54 WebCore::InlineFlowBox::computeLogicalBoxHeights(WebCore::RootInlineBox*, WebCore::FractionalLayoutUnit&, WebCore::FractionalLayoutUnit&, int&, int&, bool&, bool&, bool, WTF::HashMap<WebCore::InlineTextBox const*, std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow>, WTF::PtrHash<WebCore::InlineTextBox const*>, WTF::HashTraits<WebCore::InlineTextBox const*>, WTF::HashTraits<std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow> > >&, WebCore::FontBaseline, WebCore::VerticalPositionCache&) + 820 STDERR: 12 DumpRenderTree 0x609cf5b5 WebCore::RootInlineBox::alignBoxesInBlockDirection(WebCore::FractionalLayoutUnit, WTF::HashMap<WebCore::InlineTextBox const*, std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow>, WTF::PtrHash<WebCore::InlineTextBox const*>, WTF::HashTraits<WebCore::InlineTextBox const*>, WTF::HashTraits<std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow> > >&, WebCore::VerticalPositionCache&) + 517 STDERR: 13 DumpRenderTree 0x60745607 WebCore::RenderBlock::computeBlockDirectionPositionsForLine(WebCore::RootInlineBox*, WebCore::BidiRun*, WTF::HashMap<WebCore::InlineTextBox const*, std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow>, WTF::PtrHash<WebCore::InlineTextBox const*>, WTF::HashTraits<WebCore::InlineTextBox const*>, WTF::HashTraits<std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow> > >&, WebCore::VerticalPositionCache&) + 135 STDERR: 14 DumpRenderTree 0x60745ad1 WebCore::RenderBlock::createLineBoxesFromBidiRuns(WebCore::BidiRunList<WebCore::BidiRun>&, WebCore::InlineIterator const&, WebCore::LineInfo&, WebCore::VerticalPositionCache&, WebCore::BidiRun*, WTF::Vector<WebCore::WordMeasurement, 64ul>&) + 497 STDERR: 15 DumpRenderTree 0x60747f6d WebCore::RenderBlock::layoutRunsAndFloatsInRange(WebCore::LineLayoutState&, WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>&, WebCore::InlineIterator const&, WebCore::BidiStatus const&, unsigned int) + 3357 STDERR: 16 DumpRenderTree 0x6074617e WebCore::RenderBlock::layoutRunsAndFloats(WebCore::LineLayoutState&, bool) + 1406 STDERR: 17 DumpRenderTree 0x6074eaa6 WebCore::RenderBlock::layoutInlineChildren(bool, WebCore::FractionalLayoutUnit&, WebCore::FractionalLayoutUnit&) + 1798 STDERR: 18 DumpRenderTree 0x606d03fd WebCore::RenderBlock::layoutBlock(bool, WebCore::FractionalLayoutUnit) + 1501 STDERR: 19 DumpRenderTree 0x606cf0f3 WebCore::RenderBlock::layout() + 163 STDERR: 20 DumpRenderTree 0x606dcc0d WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, WebCore::FractionalLayoutUnit&, WebCore::FractionalLayoutUnit&) + 1117 STDERR: 21 DumpRenderTree 0x606d2c6b WebCore::RenderBlock::layoutBlockChildren(bool, WebCore::FractionalLayoutUnit&) + 1499 STDERR: 22 DumpRenderTree 0x606d0427 WebCore::RenderBlock::layoutBlock(bool, WebCore::FractionalLayoutUnit) + 1543 STDERR: 23 DumpRenderTree 0x606cf0f3 WebCore::RenderBlock::layout() + 163 STDERR: 24 DumpRenderTree 0x606dcc0d WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, WebCore::FractionalLayoutUnit&, WebCore::FractionalLayoutUnit&) + 1117 STDERR: 25 DumpRenderTree 0x606d2c6b WebCore::RenderBlock::layoutBlockChildren(bool, WebCore::FractionalLayoutUnit&) + 1499 STDERR: 26 DumpRenderTree 0x606d0427 WebCore::RenderBlock::layoutBlock(bool, WebCore::FractionalLayoutUnit) + 1543 STDERR: 27 DumpRenderTree 0x606cf0f3 WebCore::RenderBlock::layout() + 163 STDERR: 28 DumpRenderTree 0x609a9531 WebCore::RenderView::layoutContent(WebCore::LayoutState const&) + 161 STDERR: 29 DumpRenderTree 0x609a9dd9 WebCore::RenderView::layout() + 1353 STDERR: 30 DumpRenderTree 0x604c9632 WebCore::FrameView::layout(bool) + 3778 STDERR: 31 DumpRenderTree 0x5d90f9df WebCore::Document::implicitClose() + 1071 STDERR: 32 DumpRenderTree 0x6034e522 WebCore::FrameLoader::checkCallImplicitClose() + 178 STDERR: 33 DumpRenderTree 0x6034e09e WebCore::FrameLoader::checkCompleted() + 366 STDERR: 34 DumpRenderTree 0x6034ca23 WebCore::FrameLoader::finishedParsing() + 195 STDERR: 35 DumpRenderTree 0x5d91d51b WebCore::Document::finishedParsing() + 651 STDERR: 36 DumpRenderTree 0x5f4320c9 WebCore::HTMLTreeBuilder::finished() + 185 STDERR: 37 DumpRenderTree 0x5f3f787b WebCore::HTMLDocumentParser::end() + 283 STDERR: 38 DumpRenderTree 0x5f3f6659 WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd() + 329 STDERR: 39 DumpRenderTree 0x5f3f6398 WebCore::HTMLDocumentParser::prepareToStopParsing() + 312 STDERR: 40 DumpRenderTree 0x5f3f6ff1 WebCore::HTMLDocumentParser::endIfDelayed() + 129 STDERR: 41 DumpRenderTree 0x5f3f6f3b WebCore::HTMLDocumentParser::resumeParsingAfterYield() + 91 STDERR: 42 DumpRenderTree 0x5f40c704 WebCore::HTMLParserScheduler::continueNextChunkTimerFired(WebCore::Timer<WebCore::HTMLParserScheduler>*) + 228 STDERR: 43 DumpRenderTree 0x5f40cdb7 WebCore::Timer<WebCore::HTMLParserScheduler>::fired() + 135 STDERR: 44 DumpRenderTree 0x5f51c96b WebCore::ThreadTimers::sharedTimerFiredInternal() + 347 STDERR: 45 DumpRenderTree 0x5f51c6ef WebCore::ThreadTimers::sharedTimerFired() + 47 STDERR: 46 DumpRenderTree 0x616afd59 webkit_glue::WebKitPlatformSupportImpl::DoTimeout() + 73 STDERR: 47 DumpRenderTree 0x616b0954 base::internal::RunnableAdapter<void (webkit_glue::WebKitPlatformSupportImpl::*)()>::Run(webkit_glue::WebKitPlatformSupportImpl*) + 132 STDERR: 48 DumpRenderTree 0x616b0853 base::internal::InvokeHelper<false, void, base::internal::RunnableAdapter<void (webkit_glue::WebKitPlatformSupportImpl::*)()>, void ()(webkit_glue::WebKitPlatformSupportImpl*)>::MakeItSo(base::internal::RunnableAdapter<void (webkit_glue::WebKitPlatformSupportImpl::*)()>, webkit_glue::WebKitPlatformSupportImpl*) + 67 STDERR: 49 DumpRenderTree 0x616b0793 base::internal::Invoker<1, base::internal::BindState<base::internal::RunnableAdapter<void (webkit_glue::WebKitPlatformSupportImpl::*)()>, void ()(webkit_glue::WebKitPlatformSupportImpl*), void ()(base::internal::UnretainedWrapper<webkit_glue::WebKitPlatformSupportImpl>)>, void ()(webkit_glue::WebKitPlatformSupportImpl*)>::Run(base::internal::BindStateBase*) + 115 STDERR: 50 DumpRenderTree 0x5dbd20fb base::Callback<void ()()>::Run() const + 75 STDERR: 51 DumpRenderTree 0x5dca7a50 base::Timer::RunScheduledTask() + 368 STDERR: 52 DumpRenderTree 0x5dca7c59 base::BaseTimerTaskInternal::Run() + 89 STDERR: 53 DumpRenderTree 0x5dca8524 base::internal::RunnableAdapter<void (base::BaseTimerTaskInternal::*)()>::Run(base::BaseTimerTaskInternal*) + 132 STDERR: 54 DumpRenderTree 0x5dca8423 base::internal::InvokeHelper<false, void, base::internal::RunnableAdapter<void (base::BaseTimerTaskInternal::*)()>, void ()(base::BaseTimerTaskInternal*)>::MakeItSo(base::internal::RunnableAdapter<void (base::BaseTimerTaskInternal::*)()>, base::BaseTimerTaskInternal*) + 67 STDERR: 55 DumpRenderTree 0x5dca835e base::internal::Invoker<1, base::internal::BindState<base::internal::RunnableAdapter<void (base::BaseTimerTaskInternal::*)()>, void ()(base::BaseTimerTaskInternal*), void ()(base::internal::OwnedWrapper<base::BaseTimerTaskInternal>)>, void ()(base::BaseTimerTaskInternal*)>::Run(base::internal::BindStateBase*) + 110 STDERR: 56 DumpRenderTree 0x5dbd20fb base::Callback<void ()()>::Run() const + 75 STDERR: 57 DumpRenderTree 0x5dbcf657 MessageLoop::RunTask(base::PendingTask const&) + 1159 STDERR: 58 DumpRenderTree 0x5dbcfb52 MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) + 98 STDERR: 59 DumpRenderTree 0x5dbcfd52 MessageLoop::DoWork() + 322 STDERR: 60 DumpRenderTree 0x5db3bccb base::MessagePumpCFRunLoopBase::RunWork() + 107 STDERR: 61 DumpRenderTree 0x5db3b482 base::MessagePumpCFRunLoopBase::RunWorkSource(void*) + 50 STDERR: ax: a069e4c0, bx: 41e201, cx: 1c, dx: f7cdcf89 STDERR: di: 41e2bc, si: 0, bp: bfff9dd8, sp: bfff9dc0, ss: 1f, flags: 10286 STDERR: ip: 607a3767, cs: 17, ds: 1f, es: 1f, fs: 0, gs: 37 752770 9 ojan 2012-10-27 08:50:27 -0700 Yikes. I swear I tried that! Anyways, I stand corrected. I'll take a look at this Monday. 767269 10 174250 tony 2012-11-14 13:53:33 -0800 Created attachment 174250 Patch 767377 11 174250 webkit.review.bot 2012-11-14 15:36:37 -0800 Comment on attachment 174250 Patch Clearing flags on attachment: 174250 Committed r134683: <http://trac.webkit.org/changeset/134683> 767378 12 webkit.review.bot 2012-11-14 15:36:42 -0800 All reviewed patches have been landed. Closing bug. 170818 2012-10-25 22:45:13 -0700 2012-10-26 11:12:01 -0700 Testcase - 3 fuzz-twister-pattern-skew-transformed1350635746.43.svg image/svg+xml 2558 inferno PGhlYWQ+PjxzdmcgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj48aGFuZGxlciBp ZD0idENGOSI+PHN0eWxlPjwhW0NEQVRBWwouYzUgeyBwb3NpdGlvbjogYWJzb2x1dGU7ICB9XV0+ PC9zdHlsZT48c2NyaXB0PjwhW0NEQVRBWwogZG9jRWxlbWVudCA9IGRvY3VtZW50LmJvZHkgPyBk b2N1bWVudC5ib2R5IDogZG9jdW1lbnQuZG9jdW1lbnRFbGVtZW50OwpmdW5jdGlvbiByZWZlcmVu Y2UoZG9tTm9kZSkge30gZnVuY3Rpb24gd2FsayhhLCBkb21Ob2RlKSB7IHthW2tleV0uZG9tTm9k ZS5wYXJlbnROb2RlLnJlbW92ZUNoaWxkKGFba2V5XS5kb21Ob2RlKTsgfX0KZnVuY3Rpb24gWihp KSB7IHJldHVybiBkb2N1bWVudC5nZXRFbGVtZW50QnlJZChpKSB9CnRDRjIgPXRDRjcgPXRDRjkg PSBaKCJ0Q0Y5Iik7CiB7CnRyeSB7IH0gY2F0Y2goZSkge30KdHJ5IHsgdENGODMgPSBkb2N1bWVu dC5jcmVhdGVUZXh0Tm9kZSgiSiBNIDM4QEJvIik7IH0gY2F0Y2goZSkge30KdHJ5IHsgZG9jRWxl bWVudC5hcHBlbmRDaGlsZCh0Q0Y4Myk7IH0gY2F0Y2goZSkge30KdHJ5IHsgdENGODQgPSBkb2N1 bWVudC5jcmVhdGVFbGVtZW50TlMoImh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiwgImZlUG9p bnRMaWdodCIpOyB9IGNhdGNoKGUpIHt9CnRyeSB7IHRDRjg2ID0gZG9jdW1lbnQuY3JlYXRlRWxl bWVudE5TKCJodHRwOi8vd3d3LnczLm9yZy8xOTk4L01hdGgvTWF0aE1MIiwgIm1zdWJzdXAiKTsg fSBjYXRjaChlKSB7fQp0cnkgeyB0Q0YxMjYuc2V0QXR0cmlidXRlKCJjbGFzcyIsICJjMiIpOyB9 IGNhdGNoKGUpIHt9CnRyeSB7IHRDRjEyNyA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnROUygiaHR0 cDovL3d3dy53My5vcmcvMTk5OS94aHRtbCIsICJJTlBVVCIpOyB9IGNhdGNoKGUpIHt9CnRyeSB7 IH0gY2F0Y2goZSkge30KdHJ5IHsgfSBjYXRjaChlKSB7fQp0cnkgeyB0Q0YxMjkuc2V0QXR0cmli dXRlKCJjbGFzcyIsICJjMjUiKTsgfSBjYXRjaChlKSB7fQp0cnkgeyB9IGNhdGNoKGUpIHt9CnNl dFRpbWVvdXQoIkNGY3Jhc2goKSIsIDI2OSk7Cn0KZnVuY3Rpb24gc2VsZWN0UmFuZ2VCZXR3ZWVu KHIsIGVOb2RlKSB7dHJ5IHsgZm9yIChpID0gMDsgaSAhPSA0OTsgaSsrKSB7IH0gfSBjYXRjaChl KSB7fQp0cnkgeyBmb3IgKGkgPSAwOyAxMjsgaSsrKSB7IH0gfSBjYXRjaChlKSB7fQp0cnkgeyB9 IGNhdGNoKGUpIHt9CnRyeSB7IH0gY2F0Y2goZSkge30KfQpmdW5jdGlvbiBDRmNyYXNoKCkgewp0 cnkgeyB9IGNhdGNoKGUpIHt9CnRyeSB7IH0gY2F0Y2goZSkge30KdHJ5IHsgdENGMjAucmVwbGFj ZUNoaWxkKHRDRjg5LCB0Q0YyMC5jaGlsZE5vZGVzWzIwICUgdENGMjAuY2hpbGROb2Rlcy5sZW5n dGhdKTsgfSBjYXRjaChlKSB7IHRyeSB7IH0gY2F0Y2goZSkge30gfQp0cnkgeyB0Q0Y1MS5hdHRy aWJ1dGVzWzE0ICUgdENGNTEuYXR0cmlidXRlcy5sZW5ndGhdLm5hbWU7IGlmIChpZC50b0xvd2Vy Q2FzZSgpICE9ICJpZCIpIHRDRjUxLnJlbW92ZUF0dHJpYnV0ZShpZCk7IH0gY2F0Y2goZSkge30K dHJ5IHsgfSBjYXRjaChlKSB7fQpzZXRUaW1lb3V0KCd0cnkgeyB0Q0YxMDYuYXBwZW5kQ2hpbGQo dENGNzcpOyB9IGNhdGNoKGUpIHt9JywgMzQpOwp0cnkgeyBpZCA9IHRDRjcyLmF0dHJpYnV0ZXNb OTkgJSB0Q0Y3Mi5hdHRyaWJ1dGVzLmxlbmd0aF0ubmFtZTsgaWYgKGlkLnRvTG93ZXJDYXNlKCkg IT0gImlkIikgdENGNzIucmVtb3ZlQXR0cmlidXRlKGlkKTsgfSBjYXRjaChlKSB7fQpzZXRUaW1l b3V0KCd0cnkgeyB0Q0Y5LmFwcGVuZENoaWxkKHRDRjgzKTsgfSBjYXRjaChlKSB7fScsIDQ0Myk7 CnRyeSB7IH0gY2F0Y2goZSkge30KdHJ5IHsgfSBjYXRjaChlKSB7fQp0cnkgeyBkb2NFbGVtZW50 LmFwcGVuZENoaWxkKHRDRjg2KTsgfSBjYXRjaChlKSB7fQp0cnkgeyB0Q0YxMjcuY2xhc3NMaXN0 LmFkZCgiYzUiKTsgfSBjYXRjaChlKSB7fQp0cnkgeyB9IGNhdGNoKGUpIHt9CnRyeSB7IH0gY2F0 Y2goZSkge30KdHJ5IHsgdENGODYuYXBwZW5kQ2hpbGQodENGMTI3KTsgfSBjYXRjaChlKSB7fQp0 cnkgeyB9IGNhdGNoKGUpIHt9CnNldFRpbWVvdXQoJ3RyeSB7IHRDRjEwMS5zZXRBdHRyaWJ1dGUo ImF0dHJpYnV0ZU5hbWUiLCAiY3kiKTsgfSBjYXRjaChlKSB7fScsIDQ4Nik7CnRyeSB7IH0gY2F0 Y2goZSkge30KdHJ5IHsgfSBjYXRjaChlKSB7fQp0cnkgeyB0Q0YwLmluc2VydEJlZm9yZSh0Q0Yz MiwgdENGMC5jaGlsZE5vZGVzWzQ1ICUgdENGMC5jaGlsZE5vZGVzLmxlbmd0aF0pOyB9IGNhdGNo KGUpIHsgdHJ5IHsgfSBjYXRjaChlKSB7fSB9CnRyeSB7IH0gY2F0Y2goZSkge30KdHJ5IHsgfSBj YXRjaChlKSB7fQp0cnkgeyB9IGNhdGNoKGUpIHt9CnRyeSB7IHRDRjEwNi5zZXRBdHRyaWJ1dGUo ImNtIiwgIk5ld3NNZW51TDEiKTsgfSBjYXRjaChlKSB7fQp0cnkgeyB0Q0Y4Ni5zY3JvbGxJbnRv VmlldyhmYWxzZSk7IH0gY2F0Y2goZSkge30KdHJ5IHsgdENGNy5hcHBlbmRDaGlsZCh0Q0YxMjcp OyB9IGNhdGNoKGUpIHt9CnRyeSB7IH0gY2F0Y2goZSkge30KfV1dPjwvc2NyaXB0Pj4= 170954 2012-10-26 10:42:23 -0700 2012-10-26 11:12:01 -0700 reduced testcase scratch2.html text/html 485 ojan PGJvZHk+CjxzY3JpcHQ+CnRleHROb2RlID0gZG9jdW1lbnQuY3JlYXRlVGV4dE5vZGUoInRleHQi KTsKZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZCh0ZXh0Tm9kZSk7CnN1YnN1cCA9IGRvY3VtZW50 LmNyZWF0ZUVsZW1lbnROUygiaHR0cDovL3d3dy53My5vcmcvMTk5OC9NYXRoL01hdGhNTCIsICJt c3Vic3VwIik7CmRvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoc3Vic3VwKTsKeGh0bWxJbnB1dCA9 IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnROUygiaHR0cDovL3d3dy53My5vcmcvMTk5OS94aHRtbCIs ICJpbnB1dCIpOwp4aHRtbElucHV0LnN0eWxlLnBvc2l0aW9uID0gJ2Fic29sdXRlJzsKc3Vic3Vw LmFwcGVuZENoaWxkKHhodG1sSW5wdXQpOwpzdWJzdXAuc2Nyb2xsSW50b1ZpZXcoKTsKZG9jdW1l bnQuYm9keS5hcHBlbmRDaGlsZCh4aHRtbElucHV0KTsKZG9jdW1lbnQuYm9keS5hcHBlbmRDaGls ZCh0ZXh0Tm9kZSkKPC9zY3JpcHQ+CjwvYm9keT4= 170964 2012-10-26 11:12:01 -0700 2012-10-26 11:12:01 -0700 more minimal test case scratch2.html text/html 457 ojan PGJvZHk+CjxzY3JpcHQ+CnRleHROb2RlID0gZG9jdW1lbnQuY3JlYXRlVGV4dE5vZGUoInRleHQi KTsKZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZCh0ZXh0Tm9kZSk7CnN1YnN1cCA9IGRvY3VtZW50 LmNyZWF0ZUVsZW1lbnROUygiaHR0cDovL3d3dy53My5vcmcvMTk5OC9NYXRoL01hdGhNTCIsICJt c3Vic3VwIik7CmRvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoc3Vic3VwKTsKeGh0bWxJbnB1dCA9 IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnROUygiaHR0cDovL3d3dy53My5vcmcvMTk5OS94aHRtbCIs ICJpbnB1dCIpOwp4aHRtbElucHV0LnN0eWxlLnBvc2l0aW9uID0gJ2Fic29sdXRlJzsKc3Vic3Vw LmFwcGVuZENoaWxkKHhodG1sSW5wdXQpOwoKLy8gRm9yY2UgbGF5b3V0LgpzdWJzdXAub2Zmc2V0 SGVpZ2h0OwoKc3Vic3VwLnJlbW92ZUNoaWxkKHhodG1sSW5wdXQpOwo8L3NjcmlwdD4KPC9ib2R5 Pg== 171073 2012-10-26 22:26:35 -0700 2012-10-26 22:26:35 -0700 Ojan's test case without MathML 465-4.html text/html 359 dbarton PHN0eWxlPgogICAgI21zdWJzdXAsICNhbm9uIHsgZGlzcGxheTogLXdlYmtpdC1pbmxpbmUtZmxl eCB9Cjwvc3R5bGU+Cgo8ZGl2IGlkPSJtc3Vic3VwIj48ZGl2IGlkPSJhbm9uIj48ZGl2IGlkPSJp bnB1dCIgc3R5bGU9InBvc2l0aW9uOiBhYnNvbHV0ZSI+eDwvZGl2PjwvZGl2PjwvZGl2PgoKPHNj cmlwdD4KdmFyIG1zdWJzdXAgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgibXN1YnN1cCIpLCBp bnB1dCA9IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJpbnB1dCIpOwoKLy8gRm9yY2UgbGF5b3V0 Lgptc3Vic3VwLm9mZnNldEhlaWdodDsKCm1zdWJzdXAuZmlyc3RDaGlsZC5yZW1vdmVDaGlsZChp bnB1dCk7Cjwvc2NyaXB0Pgo= 174250 2012-11-14 13:53:33 -0800 2012-11-14 15:36:37 -0800 Patch bug-100465-20121114135132.patch text/plain 7230 tony U3VidmVyc2lvbiBSZXZpc2lvbjogMTM0NjIyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYzhjMTcyOTU5NThjMTU1 MjEwYjM5Y2MyMmJmOTJhYjY4Yzg0NjMxNC4uNjA1NTdlZGM3MzY0NmRmMTQ1ZjFlYmU5N2I0MmQ4 OGEyYTAwYTM5YSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI5IEBACisyMDEyLTExLTE0ICBUb255 IENoYW5nICA8dG9ueUBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgQ3Jhc2ggaW4gZmxleGJveCB3 aGVuIHJlbW92aW5nIGFic29sdXRlbHkgcG9zaXRpb25lZCBjaGlsZHJlbgorICAgICAgICBodHRw czovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTAwNDY1CisKKyAgICAgICAgUmV2 aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgV2UgdXNlIG1fbnVtYmVyT2ZDaGls ZHJlbk9uRmlyc3RMaW5lIHdoZW4gY29tcHV0aW5nIGJhc2VsaW5lIGFsaWdubWVudC4KKyAgICAg ICAgVGhpcyB2YWx1ZSBnZXRzIHNldCBkdXJpbmcgZmxleGJveCBsYXlvdXQuIFdoZW4gd2UgcmVt b3ZlIGFuIGFic29sdXRlbHkKKyAgICAgICAgcG9zaXRpb25lZCBjaGlsZCwgd2UgZG9uJ3QgcmVs YXlvdXQgYW5kIHRoaXMgdmFsdWUgd291bGQgZ2V0IHN0YWxlLgorCisgICAgICAgIENoYW5nZSBt X251bWJlck9mQ2hpbGRyZW5PbkZpcnN0TGluZSB0byBtX251bWJlck9mSW5GbG93Q2hpbGRyZW5P bkZpcnN0TGluZQorICAgICAgICBzbyB0aGUgdmFsdWUgZG9lc24ndCBnZXQgc3RhbGUgd2hlbiB3 ZSByZW1vdmUgYWJzb2x1dGVseSBwb3NpdGlvbmVkIGNoaWxkcmVuLgorICAgICAgICBBbHNvIGNo YW5nZSB0aGUgbG9vcCBpbiBmaXJzdExpbmVCb3hCYXNlbGluZSB0byBiYWlsIGlmIHdlIHJ1biBv ZmYgdGhlIGVuZCBvZgorICAgICAgICB0aGUgaXRlcmF0b3IuCisKKyAgICAgICAgVGVzdDogY3Nz My9mbGV4Ym94L2NyYXNoLXJlbW92aW5nLW91dC1vZi1mbG93LWNoaWxkLmh0bWwKKworICAgICAg ICAqIHJlbmRlcmluZy9SZW5kZXJGbGV4aWJsZUJveC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpS ZW5kZXJGbGV4aWJsZUJveDo6UmVuZGVyRmxleGlibGVCb3gpOgorICAgICAgICAoV2ViQ29yZTo6 UmVuZGVyRmxleGlibGVCb3g6OmZpcnN0TGluZUJveEJhc2VsaW5lKToKKyAgICAgICAgKFdlYkNv cmU6OlJlbmRlckZsZXhpYmxlQm94OjpsYXlvdXRCbG9jayk6CisgICAgICAgIChXZWJDb3JlOjpS ZW5kZXJGbGV4aWJsZUJveDo6cmVwb3NpdGlvbkxvZ2ljYWxIZWlnaHREZXBlbmRlbnRGbGV4SXRl bXMpOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVyRmxleGlibGVCb3g6OmxheW91dEFuZFBsYWNl Q2hpbGRyZW4pOgorICAgICAgICAqIHJlbmRlcmluZy9SZW5kZXJGbGV4aWJsZUJveC5oOgorCiAy MDEyLTExLTE0ICBTZXJnaW8gVmlsbGFyIFNlbmluICA8c3ZpbGxhckBpZ2FsaWEuY29tPgogCiAg ICAgICAgIFtRdF0gVXNlIGEgbm9kZSBpbWFnZSBpZiB0aGVyZSBpcyBubyBkcmFnIGltYWdlIHNl dCBmb3IgRHJhZyZEcm9wCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVu ZGVyRmxleGlibGVCb3guY3BwIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckZsZXhp YmxlQm94LmNwcAppbmRleCAyZTA4YTVjZGY1MTE0OWFmM2NiNjhhZmYxNmVhNjBhYzA5YzFmODA4 Li5lMTFkODY1ZjFmZTA2Nzc4MzFkYjgyYjE5ZGViMmQ4NGUwNTJmODJiIDEwMDY0NAotLS0gYS9T b3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyRmxleGlibGVCb3guY3BwCisrKyBiL1NvdXJj ZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJGbGV4aWJsZUJveC5jcHAKQEAgLTEzMiw3ICsxMzIs NyBAQCBzdHJ1Y3QgUmVuZGVyRmxleGlibGVCb3g6OlZpb2xhdGlvbiB7CiAKIFJlbmRlckZsZXhp YmxlQm94OjpSZW5kZXJGbGV4aWJsZUJveChOb2RlKiBub2RlKQogICAgIDogUmVuZGVyQmxvY2so bm9kZSkKLSAgICAsIG1fbnVtYmVyT2ZDaGlsZHJlbk9uRmlyc3RMaW5lKDApCisgICAgLCBtX251 bWJlck9mSW5GbG93Q2hpbGRyZW5PbkZpcnN0TGluZSgtMSkKIHsKICAgICBzZXRDaGlsZHJlbklu bGluZShmYWxzZSk7IC8vIEFsbCBvZiBvdXIgY2hpbGRyZW4gbXVzdCBiZSBibG9jay1sZXZlbC4K IH0KQEAgLTI1NCwxMSArMjU0LDExIEBAIGludCBSZW5kZXJGbGV4aWJsZUJveDo6Zmlyc3RMaW5l Qm94QmFzZWxpbmUoKSBjb25zdAogewogICAgIEFTU0VSVChtX29yZGVySXRlcmF0b3IpOwogCi0g ICAgaWYgKGlzV3JpdGluZ01vZGVSb290KCkgfHwgIW1fbnVtYmVyT2ZDaGlsZHJlbk9uRmlyc3RM aW5lKQorICAgIGlmIChpc1dyaXRpbmdNb2RlUm9vdCgpIHx8IG1fbnVtYmVyT2ZJbkZsb3dDaGls ZHJlbk9uRmlyc3RMaW5lIDw9IDApCiAgICAgICAgIHJldHVybiAtMTsKICAgICBSZW5kZXJCb3gq IGJhc2VsaW5lQ2hpbGQgPSAwOwotICAgIFJlbmRlckJveCogY2hpbGQgPSBtX29yZGVySXRlcmF0 b3ItPmZpcnN0KCk7Ci0gICAgZm9yIChzaXplX3QgY2hpbGROdW1iZXIgPSAwOyBjaGlsZE51bWJl ciA8IG1fbnVtYmVyT2ZDaGlsZHJlbk9uRmlyc3RMaW5lOyArK2NoaWxkTnVtYmVyLCBjaGlsZCA9 IG1fb3JkZXJJdGVyYXRvci0+bmV4dCgpKSB7CisgICAgaW50IGNoaWxkTnVtYmVyID0gMDsKKyAg ICBmb3IgKFJlbmRlckJveCogY2hpbGQgPSBtX29yZGVySXRlcmF0b3ItPmZpcnN0KCk7IGNoaWxk OyBjaGlsZCA9IG1fb3JkZXJJdGVyYXRvci0+bmV4dCgpKSB7CiAgICAgICAgIGlmIChjaGlsZC0+ aXNPdXRPZkZsb3dQb3NpdGlvbmVkKCkpCiAgICAgICAgICAgICBjb250aW51ZTsKICAgICAgICAg aWYgKGFsaWdubWVudEZvckNoaWxkKGNoaWxkKSA9PSBBbGlnbkJhc2VsaW5lICYmICFoYXNBdXRv TWFyZ2luc0luQ3Jvc3NBeGlzKGNoaWxkKSkgewpAQCAtMjY3LDYgKzI2NywxMCBAQCBpbnQgUmVu ZGVyRmxleGlibGVCb3g6OmZpcnN0TGluZUJveEJhc2VsaW5lKCkgY29uc3QKICAgICAgICAgfQog ICAgICAgICBpZiAoIWJhc2VsaW5lQ2hpbGQpCiAgICAgICAgICAgICBiYXNlbGluZUNoaWxkID0g Y2hpbGQ7CisKKyAgICAgICAgKytjaGlsZE51bWJlcjsKKyAgICAgICAgaWYgKGNoaWxkTnVtYmVy ID09IG1fbnVtYmVyT2ZJbkZsb3dDaGlsZHJlbk9uRmlyc3RMaW5lKQorICAgICAgICAgICAgYnJl YWs7CiAgICAgfQogCiAgICAgaWYgKCFiYXNlbGluZUNoaWxkKQpAQCAtMzIwLDYgKzMyNCw3IEBA IHZvaWQgUmVuZGVyRmxleGlibGVCb3g6OmxheW91dEJsb2NrKGJvb2wgcmVsYXlvdXRDaGlsZHJl biwgTGF5b3V0VW5pdCkKICAgICBzZXRMb2dpY2FsSGVpZ2h0KDApOwogICAgIHVwZGF0ZUxvZ2lj YWxXaWR0aCgpOwogCisgICAgbV9udW1iZXJPZkluRmxvd0NoaWxkcmVuT25GaXJzdExpbmUgPSAt MTsKICAgICBtX292ZXJmbG93LmNsZWFyKCk7CiAKICAgICBSZW5kZXJCbG9jazo6c3RhcnREZWxh eVVwZGF0ZVNjcm9sbEluZm8oKTsKQEAgLTM4Niw4ICszOTEsNiBAQCB2b2lkIFJlbmRlckZsZXhp YmxlQm94OjpyZXBvc2l0aW9uTG9naWNhbEhlaWdodERlcGVuZGVudEZsZXhJdGVtcyhPcmRlckl0 ZXJhdG9yJgogICAgICAgICBmbGlwRm9yV3JhcFJldmVyc2UoaXRlcmF0b3IsIGxpbmVDb250ZXh0 cywgY3Jvc3NBeGlzU3RhcnRFZGdlKTsKICAgICB9CiAKLSAgICBtX251bWJlck9mQ2hpbGRyZW5P bkZpcnN0TGluZSA9IGxpbmVDb250ZXh0cy5pc0VtcHR5KCkgPyAwIDogbGluZUNvbnRleHRzWzBd Lm51bWJlck9mQ2hpbGRyZW47Ci0KICAgICAvLyBkaXJlY3Rpb246cnRsICsgZmxleC1kaXJlY3Rp b246Y29sdW1uIG1lYW5zIHRoZSBjcm9zcy1heGlzIGRpcmVjdGlvbiBpcyBmbGlwcGVkLgogICAg IGZsaXBGb3JSaWdodFRvTGVmdENvbHVtbihpdGVyYXRvcik7CiB9CkBAIC0xMTMyLDYgKzExMzUs OCBAQCB2b2lkIFJlbmRlckZsZXhpYmxlQm94OjpsYXlvdXRBbmRQbGFjZUNoaWxkcmVuKExheW91 dFVuaXQmIGNyb3NzQXhpc09mZnNldCwgY29ucwogICAgICAgICBsYXlvdXRDb2x1bW5SZXZlcnNl KGNoaWxkcmVuLCBjcm9zc0F4aXNPZmZzZXQsIGF2YWlsYWJsZUZyZWVTcGFjZSk7CiAgICAgfQog CisgICAgaWYgKG1fbnVtYmVyT2ZJbkZsb3dDaGlsZHJlbk9uRmlyc3RMaW5lID09IC0xKQorICAg ICAgICBtX251bWJlck9mSW5GbG93Q2hpbGRyZW5PbkZpcnN0TGluZSA9IHNlZW5JbkZsb3dQb3Np dGlvbmVkQ2hpbGRyZW47CiAgICAgbGluZUNvbnRleHRzLmFwcGVuZChMaW5lQ29udGV4dChjcm9z c0F4aXNPZmZzZXQsIG1heENoaWxkQ3Jvc3NBeGlzRXh0ZW50LCBjaGlsZHJlbi5zaXplKCksIG1h eEFzY2VudCkpOwogICAgIGNyb3NzQXhpc09mZnNldCArPSBtYXhDaGlsZENyb3NzQXhpc0V4dGVu dDsKIH0KZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJGbGV4aWJs ZUJveC5oIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckZsZXhpYmxlQm94LmgKaW5k ZXggYWNiZGJhOTI4MTc1ZDUzOGNlY2VmZTc4MGY3MTRmYzhlNzNlMDBiYy4uOThlYWZjYTdjODBh NzRjODUxNDg1YWY1ZDg2YmQ4MjkyMjE2N2E5MiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUv cmVuZGVyaW5nL1JlbmRlckZsZXhpYmxlQm94LmgKKysrIGIvU291cmNlL1dlYkNvcmUvcmVuZGVy aW5nL1JlbmRlckZsZXhpYmxlQm94LmgKQEAgLTE0Niw3ICsxNDYsNyBAQCBwcml2YXRlOgogICAg IHZvaWQgZmxpcEZvcldyYXBSZXZlcnNlKE9yZGVySXRlcmF0b3ImLCBjb25zdCBXVEY6OlZlY3Rv cjxMaW5lQ29udGV4dD4mLCBMYXlvdXRVbml0IGNyb3NzQXhpc1N0YXJ0RWRnZSk7CiAKICAgICBP d25QdHI8T3JkZXJJdGVyYXRvcj4gbV9vcmRlckl0ZXJhdG9yOwotICAgIHNpemVfdCBtX251bWJl ck9mQ2hpbGRyZW5PbkZpcnN0TGluZTsKKyAgICBpbnQgbV9udW1iZXJPZkluRmxvd0NoaWxkcmVu T25GaXJzdExpbmU7CiB9OwogCiB9IC8vIG5hbWVzcGFjZSBXZWJDb3JlCmRpZmYgLS1naXQgYS9M YXlvdXRUZXN0cy9DaGFuZ2VMb2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXggYzBjNjUz NGI0ZGM1MThhZjFkNDllYjljNDk4YzYyMTBkYTM1M2ZlOC4uMWQ3NjViZDJhMDg1N2U3N2Q0NmFh MzY1MzhiYTM5ZjI2OTBlMzk1YSAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCisr KyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDEyLTExLTE0ICBU b255IENoYW5nICA8dG9ueUBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgQ3Jhc2ggaW4gZmxleGJv eCB3aGVuIHJlbW92aW5nIGFic29sdXRlbHkgcG9zaXRpb25lZCBjaGlsZHJlbgorICAgICAgICBo dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTAwNDY1CisKKyAgICAgICAg UmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGVzdCBjYXNlIGZvciB0aGUg Y3Jhc2guCisKKyAgICAgICAgKiBjc3MzL2ZsZXhib3gvY3Jhc2gtcmVtb3Zpbmctb3V0LW9mLWZs b3ctY2hpbGQtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBjc3MzL2ZsZXhib3gvY3Jh c2gtcmVtb3Zpbmctb3V0LW9mLWZsb3ctY2hpbGQuaHRtbDogQWRkZWQuCisKIDIwMTItMTEtMTQg IERpbWl0cmkgR2xhemtvdiAgPGRnbGF6a292QGNocm9taXVtLm9yZz4KIAogICAgICAgICBbQ2hy b21pdW1dIE1hcmsgd2ViZ2wtYmFja2dyb3VuZC1jb2xvci5odG1sIGFzIGZhaWxpbmcuCmRpZmYg LS1naXQgYS9MYXlvdXRUZXN0cy9jc3MzL2ZsZXhib3gvY3Jhc2gtcmVtb3Zpbmctb3V0LW9mLWZs b3ctY2hpbGQtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvY3NzMy9mbGV4Ym94L2NyYXNoLXJl bW92aW5nLW91dC1vZi1mbG93LWNoaWxkLWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0 NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi43YjUwZDUy NDUwZDZmMTM3ZTZlMTIyZGQ5YWMzZjZjZWU5MWZhOThiCi0tLSAvZGV2L251bGwKKysrIGIvTGF5 b3V0VGVzdHMvY3NzMy9mbGV4Ym94L2NyYXNoLXJlbW92aW5nLW91dC1vZi1mbG93LWNoaWxkLWV4 cGVjdGVkLnR4dApAQCAtMCwwICsxLDMgQEAKK1RoaXMgdGVzdCBwYXNzZXMgaWYgaXQgZG9lc24n dCBjcmFzaC4KKworVGhpcyB0ZXN0IHBhc3NlcyBpZiBpdCBkb2Vzbid0IGNyYXNoLgpkaWZmIC0t Z2l0IGEvTGF5b3V0VGVzdHMvY3NzMy9mbGV4Ym94L2NyYXNoLXJlbW92aW5nLW91dC1vZi1mbG93 LWNoaWxkLmh0bWwgYi9MYXlvdXRUZXN0cy9jc3MzL2ZsZXhib3gvY3Jhc2gtcmVtb3Zpbmctb3V0 LW9mLWZsb3ctY2hpbGQuaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi5iY2YyNWYyYjQ2MGNkMDZiNmRmZmI1NDRm MDlkZmNkMzNiMDE4YzU3Ci0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvY3NzMy9mbGV4 Ym94L2NyYXNoLXJlbW92aW5nLW91dC1vZi1mbG93LWNoaWxkLmh0bWwKQEAgLTAsMCArMSwyNyBA QAorPCFET0NUWVBFIGh0bWw+Cis8aHRtbD4KKzxoZWFkPgorPGxpbmsgaHJlZj0icmVzb3VyY2Vz L2ZsZXhib3guY3NzIiByZWw9InN0eWxlc2hlZXQiPgorPC9oZWFkPgorPGJvZHk+CisKKzxwPlRo aXMgdGVzdCBwYXNzZXMgaWYgaXQgZG9lc24ndCBjcmFzaC48L3A+CisKKzxkaXYgaWQ9Im91dGVy IiBjbGFzcz0iaW5saW5lLWZsZXhib3giPjxkaXYgY2xhc3M9ImlubGluZS1mbGV4Ym94Ij48ZGl2 IGlkPSJpbm5lciIgc3R5bGU9InBvc2l0aW9uOiBhYnNvbHV0ZSI+YWJzb2x1dGU8L2Rpdj48L2Rp dj48L2Rpdj4KKworPHNjcmlwdD4KK2lmICh3aW5kb3cudGVzdFJ1bm5lcikKKyAgICB0ZXN0UnVu bmVyLmR1bXBBc1RleHQoKTsKKwordmFyIG91dGVyID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQo Im91dGVyIik7Cit2YXIgaW5uZXIgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiaW5uZXIiKTsK KworLy8gRm9yY2UgbGF5b3V0Lgorb3V0ZXIub2Zmc2V0SGVpZ2h0OworCitvdXRlci5maXJzdENo aWxkLnJlbW92ZUNoaWxkKGlubmVyKTsKKzwvc2NyaXB0PgorCis8ZGl2PlRoaXMgdGVzdCBwYXNz ZXMgaWYgaXQgZG9lc24ndCBjcmFzaC48L2Rpdj4KKzwvYm9keT4KKzwvaHRtbD4K