100688 2012-10-29 10:28:18 -0700 REGRESSION (r132699): Crashes in WebCore::TextIterator::handleTextNodeFirstLetter 2013-07-31 07:30:26 -0700 1 1 1 Unclassified WebKit WebKitGTK 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED Gtk, LayoutTestFailure P2 Normal --- 1 zan dmazzoni aboxhall apinheiro cfleizach dmazzoni jdiggs jussi.kukkonen mario mrobinson rniwa spena webkit.review.bot oldest_to_newest 753585 0 zan 2012-10-29 10:28:18 -0700 The following tests started (occasionally) crashing on the GTK builders after r132699: fast/css-generated-content/first-letter-table-cell-format-block-crash.html fast/text/text-fragment-first-letter-update-crash.html fast/text/custom-font-data-crash2.html fast/css/first-letter-text-fragment-crash.html editing/selection/first-letter-selection-crash.html editing/text-iterator/backward-textiterator-first-letter-crash.html http://trac.webkit.org/changeset/132699 http://test-results.appspot.com/dashboards/flakiness_dashboard.html#group=%40ToT%20-%20webkit.org&tests=fast%2Fcss-generated-content%2Ffirst-letter-table-cell-format-block-crash.html%20fast%2Ftext%2Ftext-fragment-first-letter-update-crash.html%20fast%2Ftext%2Fcustom-font-data-crash2.html%20fast%2Fcss%2Ffirst-letter-text-fragment-crash.html%20editing%2Fselection%2Ffirst-letter-selection-crash.html%20editing%2Ftext-iterator%2Fbackward-textiterator-first-letter-crash.html The tests only crash if the accessibility tests are run before them, probably because of the accessibility object cache being populated. Here's the crash log for fast/text/custom-font-data-crash2.html crash that occurred on the 64-bit Release builder: Crash log for DumpRenderTree (pid 5474): ... [New LWP 6022] [Thread debugging using libthread_db enabled] Core was generated by `/home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/Programs/D'. Program terminated with signal 11, Segmentation fault. #0 0x00007fb3bf1f57a3 in WebCore::TextIterator::handleTextNodeFirstLetter(WebCore::RenderTextFragment*) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 ... Thread 1 (Thread 0x7fb3c0a03900 (LWP 5474)): #0 0x00007fb3bf1f57a3 in WebCore::TextIterator::handleTextNodeFirstLetter(WebCore::RenderTextFragment*) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #1 0x00007fb3bf1f842f in WebCore::TextIterator::handleTextNode() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #2 0x00007fb3bf1f8aea in WebCore::TextIterator::advance() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #3 0x00007fb3bf1f991d in WebCore::plainTextToMallocAllocatedBuffer(WebCore::Range const*, unsigned int&, bool, WebCore::TextIteratorBehavior) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #4 0x00007fb3bf1f9cca in WebCore::plainText(WebCore::Range const*, WebCore::TextIteratorBehavior) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #5 0x00007fb3beeefca3 in WebCore::AccessibilityRenderObject::textUnderElement() const () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #6 0x00007fb3bff0f659 in WebCore::AccessibilityObject::accessibilityPlatformIncludesObject() const () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #7 0x00007fb3beef3f70 in WebCore::AccessibilityRenderObject::accessibilityIsIgnoredBase() const () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #8 0x00007fb3beef8c96 in WebCore::AccessibilityRenderObject::accessibilityIsIgnored() const () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #9 0x00007fb3beefe2c3 in WebCore::AXObjectCache::childrenChanged(WebCore::AccessibilityObject*) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #10 0x00007fb3bf743c64 in WebCore::RenderObject::willBeDestroyed() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #11 0x00007fb3bf78c2a1 in WebCore::RenderText::willBeDestroyed() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #12 0x00007fb3bf74278d in WebCore::RenderObject::destroy() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #13 0x00007fb3bf7380d4 in WebCore::RenderObjectChildList::destroyLeftoverChildren() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #14 0x00007fb3bf670cec in WebCore::RenderBlock::willBeDestroyed() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #15 0x00007fb3bf74278d in WebCore::RenderObject::destroy() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #16 0x00007fb3bf12eacf in WebCore::Node::detach() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #17 0x00007fb3bf0c767e in WebCore::ContainerNode::detach() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #18 0x00007fb3bf10fda4 in WebCore::Element::detach() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #19 0x00007fb3bf0cb800 in WebCore::ContainerNode::removeChildren() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #20 0x00007fb3bf1d34dc in WebCore::replaceChildrenWithFragment(WebCore::ContainerNode*, WTF::PassRefPtr<WebCore::DocumentFragment>, int&) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #21 0x00007fb3bf27564a in WebCore::HTMLElement::setInnerHTML(WTF::String const&, int&) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #22 0x00007fb3bfb43794 in WebCore::setJSHTMLElementInnerHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValue) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #23 0x00007fb3bfb42f0c in WebCore::JSHTMLElement::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #24 0x00007fb3bfb2a381 in WebCore::JSHTMLBodyElement::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #25 0x00007fb3c079e413 in llint_slow_path_put_by_id () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libjavascriptcoregtk-3.0.so.0 #26 0x00007fb3c07a946a in llint_op_put_by_id () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libjavascriptcoregtk-3.0.so.0 #27 0x00007fb300000000 in ?? () #28 0x0000000000000000 in ?? () 753782 1 dmazzoni 2012-10-29 14:51:05 -0700 Thanks. I will look at this. FYI, it's quite likely that r132699 didn't cause these crashes, it exposed them. In particular, r132699 causes AccessibilityObjects to be created a little bit more often than before - and that is resulting in us testing codepaths that weren't well-tested before. It's worth fixing these bugs directly, rather than trying to revert r132699 or find a way to modify it to not trigger these crashes. 781504 2 jussi.kukkonen 2012-12-03 09:01:50 -0800 These aren't as flaky on EFL, but I just saw the same backtrace for editing/selection/first-letter-selection-crash.html on EFL WK2 Debug bot. 809239 3 zan 2013-01-17 03:52:07 -0800 Here's the crash log for these crashes, scraped from the debug builder: Crash log for DumpRenderTree (pid 28412): ... [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `/home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/Programs/DumpR'. Program terminated with signal 11, Segmentation fault. #0 0x00007fcd5068a0b5 in WebCore::RenderObject::firstChild (this=0xf7db428) at ../../Source/WebCore/rendering/RenderObject.h:178 178 if (const RenderObjectChildList* children = virtualChildren()) ... Thread 1 (Thread 0x7fcd45bfe900 (LWP 28412)): #0 0x00007fcd5068a0b5 in WebCore::RenderObject::firstChild (this=0xf7db428) at ../../Source/WebCore/rendering/RenderObject.h:178 #1 0x00007fcd50b4f061 in WebCore::firstRenderTextInFirstLetter (firstLetter=0xf7db428) at ../../Source/WebCore/editing/TextIterator.cpp:648 #2 0x00007fcd50b4f128 in WebCore::TextIterator::handleTextNodeFirstLetter (this=0x7fffef44c840, renderer=0xf7db4b8) at ../../Source/WebCore/editing/TextIterator.cpp:661 #3 0x00007fcd50b4e85b in WebCore::TextIterator::handleTextNode (this=0x7fffef44c840) at ../../Source/WebCore/editing/TextIterator.cpp:531 #4 0x00007fcd50b4dfd0 in WebCore::TextIterator::advance (this=0x7fffef44c840) at ../../Source/WebCore/editing/TextIterator.cpp:407 #5 0x00007fcd50b4dd19 in WebCore::TextIterator::TextIterator (this=0x7fffef44c840, r=0xf78c880, behavior=28) at ../../Source/WebCore/editing/TextIterator.cpp:342 #6 0x00007fcd50b54843 in WebCore::plainText (r=0xf78c880, defaultBehavior=24, isDisplayString=false) at ../../Source/WebCore/editing/TextIterator.cpp:2569 #7 0x00007fcd5068faa1 in WebCore::AccessibilityRenderObject::textUnderElement (this=0xe43c080) at ../../Source/WebCore/accessibility/AccessibilityRenderObject.cpp:653 #8 0x00007fcd519a1486 in WebCore::AccessibilityObject::accessibilityPlatformIncludesObject (this=0xe43c080) at ../../Source/WebCore/accessibility/atk/AccessibilityObjectAtk.cpp:87 #9 0x00007fcd506915d0 in WebCore::AccessibilityRenderObject::accessibilityIsIgnoredBase (this=0xe43c080) at ../../Source/WebCore/accessibility/AccessibilityRenderObject.cpp:1118 #10 0x00007fcd50691618 in WebCore::AccessibilityRenderObject::accessibilityIsIgnored (this=0xe43c080) at ../../Source/WebCore/accessibility/AccessibilityRenderObject.cpp:1132 #11 0x00007fcd506a921a in WebCore::AXObjectCache::childrenChanged (this=0x9e7bd70, obj=0xe43c080) at ../../Source/WebCore/accessibility/AXObjectCache.cpp:591 #12 0x00007fcd506a919d in WebCore::AXObjectCache::childrenChanged (this=0x9e7bd70, renderer=0xf779b48) at ../../Source/WebCore/accessibility/AXObjectCache.cpp:581 #13 0x00007fcd511d0d9c in WebCore::RenderObject::willBeDestroyed (this=0xf7db4b8) at ../../Source/WebCore/rendering/RenderObject.cpp:2374 #14 0x00007fcd51228b7b in WebCore::RenderText::willBeDestroyed (this=0xf7db4b8) at ../../Source/WebCore/rendering/RenderText.cpp:248 #15 0x00007fcd51233d2f in WebCore::RenderTextFragment::willBeDestroyed (this=0xf7db4b8) at ../../Source/WebCore/rendering/RenderTextFragment.cpp:75 #16 0x00007fcd511d1641 in WebCore::RenderObject::destroy (this=0xf7db4b8) at ../../Source/WebCore/rendering/RenderObject.cpp:2536 #17 0x00007fcd511d161a in WebCore::RenderObject::destroyAndCleanupAnonymousWrappers (this=0xf7db4b8) at ../../Source/WebCore/rendering/RenderObject.cpp:2529 #18 0x00007fcd50a5124e in WebCore::Node::detach (this=0xf807920) at ../../Source/WebCore/dom/Node.cpp:1108 #19 0x00007fcd5097de3a in WebCore::ContainerNode::removeBetween (this=0xa2f5970, previousChild=0xe34f550, nextChild=0x0, oldChild=0xf807920) at ../../Source/WebCore/dom/ContainerNode.cpp:528 #20 0x00007fcd5097dcb7 in WebCore::ContainerNode::removeChild (this=0xa2f5970, oldChild=0xf807920, ec=@0x7fffef44ce44: 0) at ../../Source/WebCore/dom/ContainerNode.cpp:510 #21 0x00007fcd50a4f856 in WebCore::Node::remove (this=0xf807920, ec=@0x7fffef44ce44: 0) at ../../Source/WebCore/dom/Node.cpp:583 #22 0x00007fcd50b382ee in WebCore::RemoveNodeCommand::doApply (this=0xe440430) at ../../Source/WebCore/editing/RemoveNodeCommand.cpp:55 #23 0x00007fcd50acecc2 in WebCore::CompositeEditCommand::applyCommandToComposite (this=0xe3f5340, prpCommand=...) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:257 #24 0x00007fcd50acfcb9 in WebCore::CompositeEditCommand::removeNode (this=0xe3f5340, node=..., shouldAssumeContentIsAlwaysEditable=WebCore::DoNotAssumeContentIsAlwaysEditable) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:395 #25 0x00007fcd50ac65eb in WebCore::ApplyStyleCommand::surroundNodeRangeWithElement (this=0xe3f5340, passedStartNode=..., endNode=..., elementToInsert=...) at ../../Source/WebCore/editing/ApplyStyleCommand.cpp:1337 #26 0x00007fcd50ac7622 in WebCore::ApplyStyleCommand::applyInlineStyleChange (this=0xe3f5340, passedStart=..., passedEnd=..., styleChange=..., addStyledElement=WebCore::ApplyStyleCommand::AddStyledElement) at ../../Source/WebCore/editing/ApplyStyleCommand.cpp:1448 #27 0x00007fcd50ac2ee0 in WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange (this=0xe3f5340, style=0xe433450, startNode=..., pastEndNode=...) at ../../Source/WebCore/editing/ApplyStyleCommand.cpp:816 #28 0x00007fcd50ac248c in WebCore::ApplyStyleCommand::fixRangeAndApplyInlineStyle (this=0xe3f5340, style=0xe433450, start=..., end=...) at ../../Source/WebCore/editing/ApplyStyleCommand.cpp:702 #29 0x00007fcd50ac205d in WebCore::ApplyStyleCommand::applyInlineStyle (this=0xe3f5340, style=0xe433450) at ../../Source/WebCore/editing/ApplyStyleCommand.cpp:665 #30 0x00007fcd50abf15d in WebCore::ApplyStyleCommand::doApply (this=0xe3f5340) at ../../Source/WebCore/editing/ApplyStyleCommand.cpp:223 #31 0x00007fcd50acea78 in WebCore::CompositeEditCommand::apply (this=0xe3f5340) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:205 #32 0x00007fcd50ace778 in WebCore::applyCommand (command=...) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:162 #33 0x00007fcd50afd15f in WebCore::Editor::applyStyle (this=0x15cf568, style=0xf806ff0, editingAction=WebCore::EditActionUnspecified) at ../../Source/WebCore/editing/Editor.cpp:695 #34 0x00007fcd50af2968 in WebCore::applyCommandToFrame (frame=0x15cf000, source=WebCore::CommandFromDOM, action=WebCore::EditActionSetColor, style=0xf806ff0) at ../../Source/WebCore/editing/EditorCommand.cpp:111 #35 0x00007fcd50af2a40 in WebCore::executeApplyStyle (frame=0x15cf000, source=WebCore::CommandFromDOM, action=WebCore::EditActionSetColor, propertyID=WebCore::CSSPropertyColor, propertyValue="red") at ../../Source/WebCore/editing/EditorCommand.cpp:122 #36 0x00007fcd50af42f8 in WebCore::executeForeColor (frame=0x15cf000, source=WebCore::CommandFromDOM, value="red") at ../../Source/WebCore/editing/EditorCommand.cpp:439 #37 0x00007fcd50af7d62 in WebCore::Editor::Command::execute (this=0x7fffef44dc20, parameter="red", triggeringEvent=0x0) at ../../Source/WebCore/editing/EditorCommand.cpp:1704 #38 0x00007fcd5099bc7e in WebCore::Document::execCommand (this=0xf7c8c40, commandName="ForeColor", userInterface=false, value="red") at ../../Source/WebCore/dom/Document.cpp:4183 #39 0x00007fcd51462920 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fcd001180b0) at DerivedSources/WebCore/JSDocument.cpp:2603 #40 0x00007fcd034fa0e5 in ?? () #41 0x00007fffef44ddd0 in ?? () #42 0x00007fcd54916ac7 in llint_op_call () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/.libs/libjavascriptcoregtk-3.0.so.0 #43 0x00007fcd00118058 in ?? () #44 0x00000000015f0980 in ?? () #45 0x00007fffef44dd90 in ?? () #46 0x00007fcd548bbdc7 in JSC::JSStack::installTrapsAfterFrame (this=0x0, frame=0x0) at ../../Source/JavaScriptCore/interpreter/JSStackInlines.h:213 #47 0x00007fcd548bab34 in JSC::JITCode::execute (this=0x7fccf82dd620, stack=0x15f0980, callFrame=0x7fcd00118058, globalData=0x1c4e210) at ../../Source/JavaScriptCore/jit/JITCode.h:134 #48 0x00007fcd548b7c6e in JSC::Interpreter::execute (this=0x15f0970, program=0x7fccf82dd600, callFrame=0x7fcd0006e388, thisObj=0x7fcd000affc0) at ../../Source/JavaScriptCore/interpreter/Interpreter.cpp:983 #49 0x00007fcd549a9600 in JSC::evaluate (exec=0x7fcd0006e388, source=..., thisValue=..., returnedException=0x7fffef44f3e0) at ../../Source/JavaScriptCore/runtime/Completion.cpp:75 #50 0x00007fcd5071be23 in WebCore::JSMainThreadExecState::evaluate (exec=0x7fcd0006e388, source=..., thisValue=..., exception=0x7fffef44f3e0) at ../../Source/WebCore/bindings/js/JSMainThreadExecState.h:77 #51 0x00007fcd5074a884 in WebCore::ScriptController::evaluateInWorld (this=0x15cf4e8, sourceCode=..., world=0x1c82ec0) at ../../Source/WebCore/bindings/js/ScriptController.cpp:141 #52 0x00007fcd5074a99a in WebCore::ScriptController::evaluate (this=0x15cf4e8, sourceCode=...) at ../../Source/WebCore/bindings/js/ScriptController.cpp:158 #53 0x00007fcd50a856dd in WebCore::ScriptElement::executeScript (this=0xf807a80, sourceCode=...) at ../../Source/WebCore/dom/ScriptElement.cpp:304 #54 0x00007fcd50a84ec6 in WebCore::ScriptElement::prepareScript (this=0xf807a80, scriptStartPosition=..., supportLegacyTypes=WebCore::ScriptElement::DisallowLegacyTypeInTypeAttribute) at ../../Source/WebCore/dom/ScriptElement.cpp:242 #55 0x00007fcd50ca8c7a in WebCore::HTMLScriptRunner::runScript (this=0xf7ab600, script=0xf807a10, scriptStartPosition=...) at ../../Source/WebCore/html/parser/HTMLScriptRunner.cpp:290 #56 0x00007fcd50ca82b5 in WebCore::HTMLScriptRunner::execute (this=0xf7ab600, scriptElement=..., scriptStartPosition=...) at ../../Source/WebCore/html/parser/HTMLScriptRunner.cpp:170 #57 0x00007fcd50c98d97 in WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder (this=0xf75bff0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:207 #58 0x00007fcd50c98e49 in WebCore::HTMLDocumentParser::canTakeNextToken (this=0xf75bff0, mode=WebCore::HTMLDocumentParser::AllowYield, session=...) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:224 #59 0x00007fcd50c9925c in WebCore::HTMLDocumentParser::pumpTokenizer (this=0xf75bff0, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:261 #60 0x00007fcd50c98c44 in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible (this=0xf75bff0, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:180 #61 0x00007fcd50c99818 in WebCore::HTMLDocumentParser::append (this=0xf75bff0, source=...) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:368 #62 0x00007fcd50986e35 in WebCore::DecodedDataDocumentParser::flush (this=0xf75bff0, writer=0xf7982a8) at ../../Source/WebCore/dom/DecodedDataDocumentParser.cpp:60 #63 0x00007fcd50e9dd91 in WebCore::DocumentWriter::end (this=0xf7982a8) at ../../Source/WebCore/loader/DocumentWriter.cpp:241 #64 0x00007fcd50e8e68c in WebCore::DocumentLoader::finishedLoading (this=0xf798200) at ../../Source/WebCore/loader/DocumentLoader.cpp:295 #65 0x00007fcd50ee0afc in WebCore::MainResourceLoader::didFinishLoading (this=0xf7bf970, finishTime=0) at ../../Source/WebCore/loader/MainResourceLoader.cpp:563 #66 0x00007fcd50ee0c77 in WebCore::MainResourceLoader::notifyFinished (this=0xf7bf970, resource=0xf7e07e0) at ../../Source/WebCore/loader/MainResourceLoader.cpp:573 #67 0x00007fcd50e6d7fe in WebCore::CachedResource::checkNotify (this=0xf7e07e0) at ../../Source/WebCore/loader/cache/CachedResource.cpp:336 #68 0x00007fcd50e6d858 in WebCore::CachedResource::data (this=0xf7e07e0, allDataReceived=true) at ../../Source/WebCore/loader/cache/CachedResource.cpp:345 #69 0x00007fcd50e6ae8c in WebCore::CachedRawResource::data (this=0xf7e07e0, data=..., allDataReceived=true) at ../../Source/WebCore/loader/cache/CachedRawResource.cpp:72 #70 0x00007fcd50ef7e12 in WebCore::SubresourceLoader::didFinishLoading (this=0xf747cc0, finishTime=0) at ../../Source/WebCore/loader/SubresourceLoader.cpp:276 #71 0x00007fcd50eed7b9 in WebCore::ResourceLoader::didFinishLoading (this=0xf747cc0, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:457 #72 0x00007fcd518297ab in WebCore::readCallback (asyncResult=0xc08e350, data=0x9512b90) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1346 #73 0x00007fcd4f331e5f in async_ready_callback_wrapper () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgio-2.0.so.0 #74 0x00007fcd4f34c7ea in g_simple_async_result_complete () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgio-2.0.so.0 #75 0x00007fcd4f34c9b2 in complete_in_idle_cb_for_thread () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgio-2.0.so.0 #76 0x00007fcd4f179fd1 in g_idle_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0 #77 0x00007fcd4f177903 in g_main_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0 #78 0x00007fcd4f1784b3 in g_main_context_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0 #79 0x00007fcd4f1786a3 in g_main_context_iterate () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0 #80 0x00007fcd4f178ad3 in g_main_loop_run () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0 #81 0x00007fcd4fcc0e22 in gtk_main () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgtk-3.so.0 #82 0x00000000004953bf in runTest (inputLine=...) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:761 #83 0x0000000000494afd in runTestingServerLoop () at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:551 #84 0x0000000000497da3 in main (argc=2, argv=0x7fffef450aa8) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:1503 809900 4 183303 dmazzoni 2013-01-17 15:54:02 -0800 Created attachment 183303 Patch 809904 5 dmazzoni 2013-01-17 15:56:24 -0800 Here's my proposed fix, with the following reasoning: * This will fix the crash and doesn't break any existing tests. * accessibilityIsIgnored is a very hot function, it's called whenever an object is created, deleted, or modified. textUnderElement can be ridiculously expensive, especially when called on an element with a lot of descendants. So, ideally we want to avoid calling textUnderElement so often anyway. * This will probably change the ignored status of a few objects in corner cases. If these are wrong, we should write tests for them and try to come up with better heuristics. It's probably better to err on the side of including more nodes in the tree. 809912 6 jdiggs 2013-01-17 16:07:34 -0800 (In reply to comment #5) > Here's my proposed fix, with the following reasoning: > > * This will fix the crash and doesn't break any existing tests. > > * accessibilityIsIgnored is a very hot function, it's called whenever an object is created, deleted, or modified. textUnderElement can be ridiculously expensive, especially when called on an element with a lot of descendants. So, ideally we want to avoid calling textUnderElement so often anyway. Would you add a comment into the code to that effect? It was really hard to get rid of bogus elements and if we see a regression later on, it would be nice to know that we shouldn't call textUnderElement. > It's probably better to err on the side of including more nodes in the tree. That depends on if it results in accessible caret events going missing. ;) Having said that, I'll cross that bridge when I get to it. Thanks for hunting this one down. 809917 7 183305 dmazzoni 2013-01-17 16:10:30 -0800 Created attachment 183305 Patch 809919 8 dmazzoni 2013-01-17 16:11:38 -0800 (In reply to comment #6) > Would you add a comment into the code to that effect? It was really hard to get rid of bogus elements and if we see a regression later on, it would be nice to know that we shouldn't call textUnderElement. Sure, done. > > It's probably better to err on the side of including more nodes in the tree. > > That depends on if it results in accessible caret events going missing. ;) Having said that, I'll cross that bridge when I get to it. Thanks for hunting this one down. Ah, I see. If having an *extra* element in the tree causes a caret event to get lost in the future, let's debug it and see if there is another possible solution. 810678 9 jdiggs 2013-01-18 09:06:20 -0800 Since this patch seems to accomplish the same thing and passes all the regression tests, I'm fine with this. And we really need to eliminate these crashers.... 810739 10 183305 webkit.review.bot 2013-01-18 09:49:50 -0800 Comment on attachment 183305 Patch Clearing flags on attachment: 183305 Committed r140166: <http://trac.webkit.org/changeset/140166> 810741 11 webkit.review.bot 2013-01-18 09:49:55 -0800 All reviewed patches have been landed. Closing bug. 913360 12 spena 2013-07-31 07:30:26 -0700 I am unskipping these tests now as they are no longer flaky: http://webkit-test-results.appspot.com/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=fast%2Fcss-generated-content%2Ffirst-letter-table-cell-format-block-crash.html%20fast%2Ftext%2Ftext-fragment-first-letter-update-crash.html%20fast%2Ftext%2Fcustom-font-data-crash2.html%20fast%2Fcss%2Ffirst-letter-text-fragment-crash.html%20editing%2Fselection%2Ffirst-letter-selection-crash.html%20editing%2Ftext-iterator%2Fbackward-textiterator-first-letter-crash.html 183303 2013-01-17 15:54:02 -0800 2013-01-17 16:10:27 -0800 Patch bug-100688-20130117155102.patch text/plain 1791 dmazzoni U3VidmVyc2lvbiBSZXZpc2lvbjogMTQwMDM2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZDUwODhhNDIyNTk5NjQ3 MGQ0MTI5MTAxMDVjM2Q5ZjY3ODQ2N2VkOS4uNWFjZWI5NTg2MGNiYzkzMmNjMjE1NjNhOTgxYjU4 OTcwOWZiYWEzNyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE4IEBACisyMDEzLTAxLTE3ICBEb21p bmljIE1henpvbmkgIDxkbWF6em9uaUBnb29nbGUuY29tPgorCisgICAgICAgIFJFR1JFU1NJT04g KHIxMzI2OTkpOiBDcmFzaGVzIGluIFdlYkNvcmU6OlRleHRJdGVyYXRvcjo6aGFuZGxlVGV4dE5v ZGVGaXJzdExldHRlcgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j Z2k/aWQ9MTAwNjg4CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg ICAgICAgUHJldmVudCBjcmFzaGVzIHdoZW4gYWNjZXNzaWJpbGl0eU9iamVjdElzSWdub3JlZCBj YWxscyB0ZXh0VW5kZXJFbGVtZW50CisgICAgICAgIHdoaWxlIGEgc3VidHJlZSBpcyBiZWluZyBk ZXN0cm95ZWQuCisKKyAgICAgICAgQ292ZXJlZCBieSBleGlzdGluZyB0ZXN0cy4KKworICAgICAg ICAqIGFjY2Vzc2liaWxpdHkvYXRrL0FjY2Vzc2liaWxpdHlPYmplY3RBdGsuY3BwOgorICAgICAg ICAoV2ViQ29yZTo6QWNjZXNzaWJpbGl0eU9iamVjdDo6YWNjZXNzaWJpbGl0eVBsYXRmb3JtSW5j bHVkZXNPYmplY3QpOgorCiAyMDEzLTAxLTE3ICBUb255IEdlbnRpbGNvcmUgIDx0b255Z0BjaHJv bWl1bS5vcmc+CiAKICAgICAgICAgUmVtb3ZlIHVudXNlZCBmaW5pc2hXYXNDYWxsZWQoKSBtZXRo b2QKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvYXRrL0FjY2Vzc2li aWxpdHlPYmplY3RBdGsuY3BwIGIvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9hdGsvQWNj ZXNzaWJpbGl0eU9iamVjdEF0ay5jcHAKaW5kZXggMGNiN2E5NmU3NWFmMzc5ZWZlY2EwYTA2OWMz NjEwMzhmMDIyNzBiNi4uZmQ0YTA4ZGU2NmQ2NDNjNGQ2ODljM2UwZjdjMDg4NzQ4ZjVhOWU1MiAx MDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9hdGsvQWNjZXNzaWJpbGl0 eU9iamVjdEF0ay5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9hdGsvQWNj ZXNzaWJpbGl0eU9iamVjdEF0ay5jcHAKQEAgLTg0LDcgKzg0LDcgQEAgQWNjZXNzaWJpbGl0eU9i amVjdEluY2x1c2lvbiBBY2Nlc3NpYmlsaXR5T2JqZWN0OjphY2Nlc3NpYmlsaXR5UGxhdGZvcm1J bmNsdWRlc08KICAgICAvLyB1c3VhbGx5IGhhdmUgbm8gbmVlZCBmb3IgdGhlIGFub255bW91cyBi bG9jay4gQW5kIHdoZW4gdGhlIHdyb25nIG9iamVjdHMKICAgICAvLyBnZXQgaW5jbHVkZWQgb3Ig aWdub3JlZCwgbmVlZGVkIGFjY2Vzc2liaWxpdHkgc2lnbmFscyBkbyBub3QgZ2V0IGVtaXR0ZWQu CiAgICAgaWYgKHJvbGUgPT0gUGFyYWdyYXBoUm9sZSB8fCByb2xlID09IERpdlJvbGUpIHsKLSAg ICAgICAgaWYgKHRleHRVbmRlckVsZW1lbnQoKS5pc0VtcHR5KCkpCisgICAgICAgIGlmICghcmVu ZGVyZXIoKS0+Zmlyc3RDaGlsZCgpKQogICAgICAgICAgICAgcmV0dXJuIERlZmF1bHRCZWhhdmlv cjsKIAogICAgICAgICBpZiAoIXBhcmVudC0+cmVuZGVyZXIoKSB8fCBwYXJlbnQtPnJlbmRlcmVy KCktPmlzQW5vbnltb3VzQmxvY2soKSkK 183305 2013-01-17 16:10:30 -0800 2013-01-18 09:49:50 -0800 Patch bug-100688-20130117160730.patch text/plain 1952 dmazzoni U3VidmVyc2lvbiBSZXZpc2lvbjogMTQwMDM2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZDUwODhhNDIyNTk5NjQ3 MGQ0MTI5MTAxMDVjM2Q5ZjY3ODQ2N2VkOS4uNWFjZWI5NTg2MGNiYzkzMmNjMjE1NjNhOTgxYjU4 OTcwOWZiYWEzNyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE4IEBACisyMDEzLTAxLTE3ICBEb21p bmljIE1henpvbmkgIDxkbWF6em9uaUBnb29nbGUuY29tPgorCisgICAgICAgIFJFR1JFU1NJT04g KHIxMzI2OTkpOiBDcmFzaGVzIGluIFdlYkNvcmU6OlRleHRJdGVyYXRvcjo6aGFuZGxlVGV4dE5v ZGVGaXJzdExldHRlcgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j Z2k/aWQ9MTAwNjg4CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg ICAgICAgUHJldmVudCBjcmFzaGVzIHdoZW4gYWNjZXNzaWJpbGl0eU9iamVjdElzSWdub3JlZCBj YWxscyB0ZXh0VW5kZXJFbGVtZW50CisgICAgICAgIHdoaWxlIGEgc3VidHJlZSBpcyBiZWluZyBk ZXN0cm95ZWQuCisKKyAgICAgICAgQ292ZXJlZCBieSBleGlzdGluZyB0ZXN0cy4KKworICAgICAg ICAqIGFjY2Vzc2liaWxpdHkvYXRrL0FjY2Vzc2liaWxpdHlPYmplY3RBdGsuY3BwOgorICAgICAg ICAoV2ViQ29yZTo6QWNjZXNzaWJpbGl0eU9iamVjdDo6YWNjZXNzaWJpbGl0eVBsYXRmb3JtSW5j bHVkZXNPYmplY3QpOgorCiAyMDEzLTAxLTE3ICBUb255IEdlbnRpbGNvcmUgIDx0b255Z0BjaHJv bWl1bS5vcmc+CiAKICAgICAgICAgUmVtb3ZlIHVudXNlZCBmaW5pc2hXYXNDYWxsZWQoKSBtZXRo b2QKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvYXRrL0FjY2Vzc2li aWxpdHlPYmplY3RBdGsuY3BwIGIvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9hdGsvQWNj ZXNzaWJpbGl0eU9iamVjdEF0ay5jcHAKaW5kZXggMGNiN2E5NmU3NWFmMzc5ZWZlY2EwYTA2OWMz NjEwMzhmMDIyNzBiNi4uYzM5OGQ1NTM0MGRmMTM2MjhhNjIwODFhODQ1NDQxN2QyMDFiZDcxZiAx MDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9hdGsvQWNjZXNzaWJpbGl0 eU9iamVjdEF0ay5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9hdGsvQWNj ZXNzaWJpbGl0eU9iamVjdEF0ay5jcHAKQEAgLTg0LDcgKzg0LDkgQEAgQWNjZXNzaWJpbGl0eU9i amVjdEluY2x1c2lvbiBBY2Nlc3NpYmlsaXR5T2JqZWN0OjphY2Nlc3NpYmlsaXR5UGxhdGZvcm1J bmNsdWRlc08KICAgICAvLyB1c3VhbGx5IGhhdmUgbm8gbmVlZCBmb3IgdGhlIGFub255bW91cyBi bG9jay4gQW5kIHdoZW4gdGhlIHdyb25nIG9iamVjdHMKICAgICAvLyBnZXQgaW5jbHVkZWQgb3Ig aWdub3JlZCwgbmVlZGVkIGFjY2Vzc2liaWxpdHkgc2lnbmFscyBkbyBub3QgZ2V0IGVtaXR0ZWQu CiAgICAgaWYgKHJvbGUgPT0gUGFyYWdyYXBoUm9sZSB8fCByb2xlID09IERpdlJvbGUpIHsKLSAg ICAgICAgaWYgKHRleHRVbmRlckVsZW1lbnQoKS5pc0VtcHR5KCkpCisgICAgICAgIC8vIERvbid0 IGNhbGwgdGV4dFVuZGVyRWxlbWVudCgpIGhlcmUsIGJlY2F1c2UgaXQncyBzbG93IGFuZCBpdCBj YW4KKyAgICAgICAgLy8gY3Jhc2ggd2hlbiBjYWxsZWQgd2hpbGUgd2UncmUgaW4gdGhlIG1pZGRs ZSBvZiBhIHN1YnRyZWUgYmVpbmcgZGVsZXRlZC4KKyAgICAgICAgaWYgKCFyZW5kZXJlcigpLT5m aXJzdENoaWxkKCkpCiAgICAgICAgICAgICByZXR1cm4gRGVmYXVsdEJlaGF2aW9yOwogCiAgICAg ICAgIGlmICghcGFyZW50LT5yZW5kZXJlcigpIHx8IHBhcmVudC0+cmVuZGVyZXIoKS0+aXNBbm9u eW1vdXNCbG9jaygpKQo=