13243 2007-03-31 06:10:46 -0700 REGRESSION (r20506): Repro crash/assert when using scroll wheel on a list box taller than its contents 2007-03-31 22:24:04 -0700 1 1 1 Unclassified WebKit Forms 523.x (Safari 3) Mac OS X 10.4 RESOLVED FIXED data:text/html,<select multiple><option>Scrollwheel here</option></select> InRadar, Regression P1 Critical --- 1 mitz webkit-unassigned oldest_to_newest 16145 0 mitz 2007-03-31 06:10:46 -0700 Open the URL, position the mouse inside the list box and use the scroll wheel to scroll up or down. Crashes r20610. In a debug build you get: ASSERTION FAILED: i < size() (JavaScriptCore.framework/PrivateHeaders/Vector.h:406 const T& WTF::Vector<T, inlineCapacity>::at(size_t) const [with T = WebCore::HTMLElement*, long unsigned int inlineCapacity = 0ul]) Thread 0 Crashed: 0 com.apple.WebCore 0x0165f2b8 WTF::Vector<WebCore::HTMLElement*, (unsigned long)0>::at(unsigned long) const + 120 (Vector.h:406) 1 com.apple.WebCore 0x0165f320 WTF::Vector<WebCore::HTMLElement*, (unsigned long)0>::operator[](int) const + 44 (Vector.h:415) 2 com.apple.WebCore 0x0144b4f8 WebCore::RenderListBox::paintItemBackground(WebCore::RenderObject::PaintInfo&, int, int, int) + 96 (RenderListBox.cpp:351) 3 com.apple.WebCore 0x0144ce20 WebCore::RenderListBox::paintObject(WebCore::RenderObject::PaintInfo&, int, int) + 300 (RenderListBox.cpp:268) 4 com.apple.WebCore 0x01181bc4 WebCore::RenderBlock::paint(WebCore::RenderObject::PaintInfo&, int, int) + 672 (RenderBlock.cpp:1326) [...] 16136 1 13909 mitz 2007-03-31 07:02:36 -0700 Created attachment 13909 Patch 15971 2 13909 darin 2007-03-31 17:33:56 -0700 Comment on attachment 13909 Patch r=me 15892 3 mrowe 2007-03-31 22:13:03 -0700 <rdar://problem/5103226> 15897 4 mrowe 2007-03-31 22:24:04 -0700 Landed in r20645. 13909 2007-03-31 07:02:36 -0700 2007-03-31 17:33:56 -0700 Patch 13243_r1.patch text/plain 1997 mitz SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiAyMDY0MCkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTUgQEAKKzIwMDctMDMtMzEgIE1pdHogUGV0dGVsICA8bWl0ekB3ZWJraXQub3Jn PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIC0gZml4 IGh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzMjQzCisgICAgICAgICAg UkVHUkVTU0lPTiAocjIwNTA2KTogUmVwcm8gY3Jhc2gvYXNzZXJ0IHdoZW4gdXNpbmcgc2Nyb2xs IHdoZWVsIG9uIGEgbGlzdCBib3ggdGFsbGVyIHRoYW4gaXRzIGNvbnRlbnRzCisKKyAgICAgICAg KiBwbGF0Zm9ybS9TY3JvbGxCYXIuY3BwOgorICAgICAgICAoV2ViQ29yZTo6U2Nyb2xsYmFyOjpz ZXRWYWx1ZSk6IENsZWFuZWQgdXAgYSBsaXR0bGUuCisgICAgICAgIChXZWJDb3JlOjpTY3JvbGxi YXI6OnNjcm9sbCk6IENoYW5nZWQgdG8gYXBwbHkgdGhlIG1pbmltdW0gYW5kIG1heGltdW0gY29u c3RyYWludHMKKyAgICAgICAgaW4gdGhlIHJpZ2h0IG9yZGVyLCBhbmQgY2xlYW5lZCB1cCBhIGxp dHRsZS4KKwogMjAwNy0wMy0zMSAgTmljaG9sYXMgU2hhbmtzICA8d2Via2l0QG5pY2tzaGFua3Mu Y29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5IEFkZWxlLgpJbmRleDogV2ViQ29yZS9wbGF0Zm9y bS9TY3JvbGxCYXIuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvcGxhdGZvcm0vU2Nyb2xsQmFy LmNwcAkocmV2aXNpb24gMjA2MzkpCisrKyBXZWJDb3JlL3BsYXRmb3JtL1Njcm9sbEJhci5jcHAJ KHdvcmtpbmcgY29weSkKQEAgLTI2LDYgKzI2LDExIEBACiAjaW5jbHVkZSAiY29uZmlnLmgiCiAj aW5jbHVkZSAiU2Nyb2xsQmFyLmgiCiAKKyNpbmNsdWRlIDxhbGdvcml0aG0+CisKK3VzaW5nIHN0 ZDo6bWF4OwordXNpbmcgc3RkOjptaW47CisKIG5hbWVzcGFjZSBXZWJDb3JlIHsKIAogU2Nyb2xs YmFyOjpTY3JvbGxiYXIoU2Nyb2xsYmFyQ2xpZW50KiBjbGllbnQsIFNjcm9sbGJhck9yaWVudGF0 aW9uIG9yaWVudGF0aW9uLCBTY3JvbGxiYXJDb250cm9sU2l6ZSBjb250cm9sU2l6ZSkKQEAgLTQz LDExICs0OCw3IEBAIFNjcm9sbGJhcjo6U2Nyb2xsYmFyKFNjcm9sbGJhckNsaWVudCogY2wKIAog Ym9vbCBTY3JvbGxiYXI6OnNldFZhbHVlKGludCB2KQogewotICAgIGludCBtYXhQb3MgPSBtX3Rv dGFsU2l6ZSAtIG1fdmlzaWJsZVNpemU7Ci0gICAgaWYgKHYgPiBtYXhQb3MpCi0gICAgICAgIHYg PSBtYXhQb3M7Ci0gICAgaWYgKHYgPCAwKQotICAgICAgICB2ID0gMDsKKyAgICB2ID0gbWF4KG1p bih2LCBtX3RvdGFsU2l6ZSAtIG1fdmlzaWJsZVNpemUpLCAwKTsKICAgICBpZiAodmFsdWUoKSA9 PSB2KQogICAgICAgICByZXR1cm4gZmFsc2U7IC8vIE91ciB2YWx1ZSBzdGF5ZWQgdGhlIHNhbWUu CiAgICAgbV9jdXJyZW50UG9zID0gdjsKQEAgLTk3LDEwICs5OCw4IEBAIGJvb2wgU2Nyb2xsYmFy OjpzY3JvbGwoU2Nyb2xsRGlyZWN0aW9uIGQKICAgICAgICAgCiAgICAgZmxvYXQgbmV3UG9zID0g bV9jdXJyZW50UG9zICsgc3RlcCAqIG11bHRpcGxpZXI7CiAgICAgZmxvYXQgbWF4UG9zID0gbV90 b3RhbFNpemUgLSBtX3Zpc2libGVTaXplOwotICAgIGlmIChuZXdQb3MgPCAwKQotICAgICAgICBu ZXdQb3MgPSAwOwotICAgIGlmIChuZXdQb3MgPiBtYXhQb3MpCi0gICAgICAgIG5ld1BvcyA9IG1h eFBvczsKKyAgICBuZXdQb3MgPSBtYXgobWluKG5ld1BvcywgbWF4UG9zKSwgMC4wZik7CisKICAg ICBpZiAobmV3UG9zID09IG1fY3VycmVudFBvcykKICAgICAgICAgcmV0dXJuIGZhbHNlOwogICAg IAo=