112078 2013-03-11 16:15:17 -0700 SVG text path referencing parent text infinite loops 2015-04-27 15:06:11 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 schenney schenney d-r eric fmalita krit pdr webkit.review.bot zimmermann oldest_to_newest 852835 0 schenney 2013-03-11 16:15:17 -0700 See attached repro, which apparently infinitely loops then crashes in DRT. Chromium https://code.google.com/p/chromium/issues/detail?id=181447 #8 0x0000000001165c5f in WTF::HashMap<WebCore::SVGElement*, WTF::OwnPtr<WTF::HashSet<WebCore::SVGElement*, WTF::PtrHash<WebCore::SVGElement*>, WTF::HashTraits<WebCore::SVGElement*> > >, WTF::PtrHash<WebCore::SVGElement*>, WTF::HashTraits<WebCore::SVGElement*>, WTF::HashTraits<WTF::OwnPtr<WTF::HashSet<WebCore::SVGElement*, WTF::PtrHash<WebCore::SVGElement*>, WTF::HashTraits<WebCore::SVGElement*> > > > >::find (this= 0x10f36f18cc30, key=@0x7fffff7ff258: 0x10f36f23a8e0) at ../../third_party/WebKit/Source/WTF/wtf/HashMap.h:299 #9 0x00000000011640a8 in WebCore::SVGDocumentExtensions::setOfElementsReferencingTarget (this=0x10f36f18cb60, referencedElement= 0x10f36f23a8e0) at ../../third_party/WebKit/Source/WebCore/svg/SVGDocumentExtensions.cpp:300 #10 0x00000000011fc22a in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f006578, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:183 #11 0x00000000011fbff8 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:202 #12 0x00000000011fc2d4 in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f341038, needsLayout=false) ---Type <return> to continue, or q <return> to quit--- at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:189 #13 0x00000000011fc024 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:207 #14 0x00000000011fc2d4 in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f341038, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:189 #15 0x00000000011fc024 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:207 #16 0x00000000011fc2d4 in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f341038, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:189 #17 0x00000000011fc024 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:207 #18 0x00000000011fc2d4 in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f341038, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:189 #19 0x00000000011fc024 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:207 #20 0x00000000011fc2d4 in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f341038, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:189 #21 0x00000000011fc024 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:207 #22 0x00000000011fc2d4 in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f341038, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:189 #23 0x00000000011fc024 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false) at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:207 852836 1 192589 schenney 2013-03-11 16:15:45 -0700 Created attachment 192589 Layout test 852926 2 192609 schenney 2013-03-11 17:55:42 -0700 Created attachment 192609 Patch 852927 3 schenney 2013-03-11 17:56:59 -0700 I also checked the case of a textpath with a path parent that it was referencing, but the crash did not happen. 860644 4 192609 pdr 2013-03-21 13:49:45 -0700 Comment on attachment 192609 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=192609&action=review R=me > LayoutTests/svg/text/textpath-referencing-text-crash-expected.txt:6 > + LF Something is up here, these lines don't usually appear. 860650 5 192609 schenney 2013-03-21 13:53:53 -0700 Comment on attachment 192609 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=192609&action=review >> LayoutTests/svg/text/textpath-referencing-text-crash-expected.txt:6 >> + LF > > Something is up here, these lines don't usually appear. It's Chromium's svn properties file, I think, and safe to leave here. 860656 6 192609 webkit.review.bot 2013-03-21 13:59:59 -0700 Comment on attachment 192609 Patch Clearing flags on attachment: 192609 Committed r146515: <http://trac.webkit.org/changeset/146515> 860657 7 webkit.review.bot 2013-03-21 14:00:03 -0700 All reviewed patches have been landed. Closing bug. 1089218 8 sabouhallawa 2015-04-27 15:06:11 -0700 *** Bug 104634 has been marked as a duplicate of this bug. *** 192589 2013-03-11 16:15:45 -0700 2013-03-11 16:15:45 -0700 Layout test textpath-referencing-text-crash.svg image/svg+xml 281 schenney PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRw Oi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KICA8dGV4dCBpZD0iYSIgZm9udC1zaXplPSIwIj4K ICAgIDx0ZXh0UGF0aCB4bGluazpocmVmPSIjYSI+PC90ZXh0UGF0aD4KICA8L3RleHQ+CiAgPHRl eHQ+VGVzdCBQYXNzZXM8L3RleHQ+CiAgPHNjcmlwdD4KICAgIGlmICh3aW5kb3cudGVzdFJ1bm5l cikKICAgICAgdGVzdFJ1bm5lci5kdW1wQXNUZXh0KCk7CiAgPC9zY3JpcHQ+Cjwvc3ZnPgo= 192609 2013-03-11 17:55:42 -0700 2013-03-21 13:59:59 -0700 Patch bug-112078-20130311205142.patch text/plain 4307 schenney SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE0NTQzMSkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI3IEBACisyMDEzLTAzLTExICBTdGVwaGVu IENoZW5uZXkgIDxzY2hlbm5leUBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgU1ZHIHRleHQgcGF0 aCByZWZlcmVuY2luZyBwYXJlbnQgdGV4dCBpbmZpbml0ZSBsb29wcworICAgICAgICBodHRwczov L2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTEyMDc4CisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgV2UgZG8gbm90IGNoZWNrIHRoZSB0YXJn ZXQgdHlwZSB3aGVuIGFkZGluZyBhIHJlc291cmNlIHJlZmVyZW5jZSBmb3IKKyAgICAgICAgU1ZH IFRleHQgUGF0aCdzIFVSSS4gVGhpcyBnb2VzIGhvcnJpYmx5IHdyb25nIHdoZW4gdGhlIHRhcmdl dCBpcyB0aGUKKyAgICAgICAgdGV4dCBwYXRoJ3MgcGFyZW50IHRleHQgZWxlbWVudC4gSW4gdGhp cyBwYXRjaCB3ZSBjaGVjayB0aGF0IHRoZSB0YXJnZXQKKyAgICAgICAgZWxlbWVudCBvZiB0aGUg dGV4dCBwYXRoIGlzIGluZGVlZCBhIHBhdGggZWxlbWVudCwgYXMgdGhlIHNwZWMKKyAgICAgICAg cmVxdWlyZXMuIE5vIG90aGVyIGVsZW1lbnQgdHlwZSBpcyBhbGxvd2VkLgorCisgICAgICAgIE5v dGUgdGhhdCBSZW5kZXJTVkdUZXh0UGF0aCBlbmZvcmNlcyB0aGlzIGNoZWNrIGluIHRoZSByZW5k ZXJlciBjb2RlCisgICAgICAgIGFsc28sIHNvIGlmIHdlIGdldCBwYXN0IHRoaXMgY2hlY2sgdmlh IHBlbmRpbmcgcmVzb3VyY2VzLCBpdCBkb2Vzbid0CisgICAgICAgIG1hdHRlci4gWW91IGNhbid0 IGdldCBpbnRvIHRoaXMgc2l0dWF0aW9uIHdpdGggYSBwZW5kaW5nIHJlZmVyZW5jZQorICAgICAg ICBiZWNhdXNlLCBieSBkZWZpbml0aW9uLCB0aGUgcGFyZW50IG11c3QgYmUgZGVmaW5lZCBiZWZv cmUgdGhlIHRleHQKKyAgICAgICAgcGF0aCBjaGlsZC4KKworICAgICAgICBUZXN0OiBzdmcvdGV4 dC90ZXh0cGF0aC1yZWZlcmVuY2luZy10ZXh0LWNyYXNoLnN2ZworCisgICAgICAgICogc3ZnL1NW R1RleHRQYXRoRWxlbWVudC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpTVkdUZXh0UGF0aEVsZW1l bnQ6OmJ1aWxkUGVuZGluZ1Jlc291cmNlKToKKwogMjAxMy0wMy0xMSAgTWFyayBMYW0gIDxtYXJr LmxhbUBhcHBsZS5jb20+CiAKICAgICAgICAgUmVtb3ZlIHRoZSB1c2Ugb2YgdGhlIHF1b3RhTWFw IGNhY2hlIGluIERhdGFiYXNlVHJhY2tlci4KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL3N2Zy9TVkdU ZXh0UGF0aEVsZW1lbnQuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL3N2Zy9TVkdU ZXh0UGF0aEVsZW1lbnQuY3BwCShyZXZpc2lvbiAxNDU0MjApCisrKyBTb3VyY2UvV2ViQ29yZS9z dmcvU1ZHVGV4dFBhdGhFbGVtZW50LmNwcAkod29ya2luZyBjb3B5KQpAQCAtMTcxLDcgKzE3MSw3 IEBAIHZvaWQgU1ZHVGV4dFBhdGhFbGVtZW50OjpidWlsZFBlbmRpbmdSZXMKICAgICAgICAgICAg IGRvY3VtZW50KCktPmFjY2Vzc1NWR0V4dGVuc2lvbnMoKS0+YWRkUGVuZGluZ1Jlc291cmNlKGlk LCB0aGlzKTsKICAgICAgICAgICAgIEFTU0VSVChoYXNQZW5kaW5nUmVzb3VyY2VzKCkpOwogICAg ICAgICB9Ci0gICAgfSBlbHNlIGlmICh0YXJnZXQtPmlzU1ZHRWxlbWVudCgpKSB7CisgICAgfSBl bHNlIGlmICh0YXJnZXQtPmhhc1RhZ05hbWUoU1ZHTmFtZXM6OnBhdGhUYWcpKSB7CiAgICAgICAg IC8vIFJlZ2lzdGVyIHVzIHdpdGggdGhlIHRhcmdldCBpbiB0aGUgZGVwZW5kZW5jaWVzIG1hcC4g QW55IGNoYW5nZSBvZiBocmVmRWxlbWVudAogICAgICAgICAvLyB0aGF0IGxlYWRzIHRvIHJlbGF5 b3V0L3JlcGFpbnRpbmcgbm93IGluZm9ybXMgdXMsIHNvIHdlIGNhbiByZWFjdCB0byBpdC4KICAg ICAgICAgZG9jdW1lbnQoKS0+YWNjZXNzU1ZHRXh0ZW5zaW9ucygpLT5hZGRFbGVtZW50UmVmZXJl bmNpbmdUYXJnZXQodGhpcywgdG9TVkdFbGVtZW50KHRhcmdldCkpOwpJbmRleDogTGF5b3V0VGVz dHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL0NoYW5nZUxvZwkocmV2aXNp b24gMTQ1NDMxKQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0x LDMgKzEsMTMgQEAKKzIwMTMtMDMtMTEgIFN0ZXBoZW4gQ2hlbm5leSAgPHNjaGVubmV5QGNocm9t aXVtLm9yZz4KKworICAgICAgICBTVkcgdGV4dCBwYXRoIHJlZmVyZW5jaW5nIHBhcmVudCB0ZXh0 IGluZmluaXRlIGxvb3BzCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD0xMTIwNzgKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKwor ICAgICAgICAqIHN2Zy90ZXh0L3RleHRwYXRoLXJlZmVyZW5jaW5nLXRleHQtY3Jhc2gtZXhwZWN0 ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBzdmcvdGV4dC90ZXh0cGF0aC1yZWZlcmVuY2luZy10 ZXh0LWNyYXNoLnN2ZzogQWRkZWQuCisKIDIwMTMtMDMtMTEgIEphbWVzIFJvYmluc29uICA8amFt ZXNyQGNocm9taXVtLm9yZz4KIAogICAgICAgICBEZS1mbGFrZSBmYXN0L2RvbS90aXRsZS1kaXJl Y3Rpb25hbGl0eS5odG1sCkluZGV4OiBMYXlvdXRUZXN0cy9zdmcvdGV4dC90ZXh0cGF0aC1yZWZl cmVuY2luZy10ZXh0LWNyYXNoLWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0 cy9zdmcvdGV4dC90ZXh0cGF0aC1yZWZlcmVuY2luZy10ZXh0LWNyYXNoLWV4cGVjdGVkLnR4dAko cmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL3N2Zy90ZXh0L3RleHRwYXRoLXJlZmVyZW5jaW5n LXRleHQtY3Jhc2gtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQpAQCAtMCwwICsxIEBACitUZXN0 IFBhc3NlcyBpZiB0aGVyZSBpcyBubyBjcmFzaC4gU2VlIGJ1ZyBodHRwczovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTEyMDc4LgoKUHJvcGVydHkgY2hhbmdlcyBvbjogTGF5b3V0 VGVzdHMvc3ZnL3RleHQvdGV4dHBhdGgtcmVmZXJlbmNpbmctdGV4dC1jcmFzaC1leHBlY3RlZC50 eHQKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXwpBZGRlZDogc3ZuOmVvbC1zdHlsZQogICArIExGCgpJbmRleDogTGF5b3V0 VGVzdHMvc3ZnL3RleHQvdGV4dHBhdGgtcmVmZXJlbmNpbmctdGV4dC1jcmFzaC5zdmcKPT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PQotLS0gTGF5b3V0VGVzdHMvc3ZnL3RleHQvdGV4dHBhdGgtcmVmZXJlbmNpbmctdGV4dC1j cmFzaC5zdmcJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9zdmcvdGV4dC90ZXh0cGF0aC1y ZWZlcmVuY2luZy10ZXh0LWNyYXNoLnN2ZwkocmV2aXNpb24gMCkKQEAgLTAsMCArMSwxMCBAQAor PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRw Oi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KKyAgPHRleHQgaWQ9ImEiIGZvbnQtc2l6ZT0iMCI+ CisgICAgPHRleHRQYXRoIHhsaW5rOmhyZWY9IiNhIj48L3RleHRQYXRoPgorICA8L3RleHQ+Cisg IDx0ZXh0PlRlc3QgUGFzc2VzIGlmIHRoZXJlIGlzIG5vIGNyYXNoLiBTZWUgYnVnIGh0dHBzOi8v YnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMTIwNzguPC90ZXh0PgorICA8c2NyaXB0 PgorICAgIGlmICh3aW5kb3cudGVzdFJ1bm5lcikKKyAgICAgIHRlc3RSdW5uZXIuZHVtcEFzVGV4 dCgpOworICA8L3NjcmlwdD4KKzwvc3ZnPgoKUHJvcGVydHkgY2hhbmdlcyBvbjogTGF5b3V0VGVz dHMvc3ZnL3RleHQvdGV4dHBhdGgtcmVmZXJlbmNpbmctdGV4dC1jcmFzaC5zdmcKX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f XwpBZGRlZDogc3ZuOmVvbC1zdHlsZQogICArIExGCgo=