135838 2014-08-12 05:46:49 -0700 ASSERTION FAILED: m_intervalBegin.isFinite() in WebCore::SVGSMILElement::notifyDependentsIntervalChanged 2014-08-18 01:57:28 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 116980 1 rhodovan.u-szeged rhodovan.u-szeged commit-queue darin dino d-r fmalita gyuyoung.kim pdr schenney sergio zimmermann oldest_to_newest 1028502 0 rhodovan.u-szeged 2014-08-12 05:46:49 -0700 The failing test case: <svg xmlns="http://www.w3.org/2000/svg"> <animateMotion begin="689328207834365109403786593332753148024s"/> </svg> Backtrace: ASSERTION FAILED: m_intervalBegin.isFinite() ../../Source/WebCore/svg/animation/SVGSMILElement.cpp(1126) : void WebCore::SVGSMILElement::notifyDependentsIntervalChanged(WebCore::SVGSMILElement::NewOrExistingInterval) Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fff97537700 (LWP 15250)] 0x000000000044c8a9 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329 329 *(int *)(uintptr_t)0xbbadbeef = 0; #0 0x000000000044c8a9 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329 #1 0x00007ffff42a66e3 in WebCore::SVGSMILElement::notifyDependentsIntervalChanged (this=0x863180, newOrExisting=WebCore::SVGSMILElement::NewInterval) at ../../Source/WebCore/svg/animation/SVGSMILElement.cpp:1126 #2 0x00007ffff42a51f1 in WebCore::SVGSMILElement::resolveFirstInterval (this=0x863180) at ../../Source/WebCore/svg/animation/SVGSMILElement.cpp:854 #3 0x00007ffff42a1b98 in WebCore::SVGSMILElement::insertedInto (this=0x863180, rootParent=...) at ../../Source/WebCore/svg/animation/SVGSMILElement.cpp:261 #4 0x00007ffff36b3a27 in WebCore::ChildNodeInsertionNotifier::notifyNodeInsertedIntoDocument (this=0x7fffffffd090, node=...) at ../../Source/WebCore/dom/ContainerNodeAlgorithms.h:200 #5 0x00007ffff36b3bdf in WebCore::ChildNodeInsertionNotifier::notify (this=0x7fffffffd090, node=...) at ../../Source/WebCore/dom/ContainerNodeAlgorithms.h:228 #6 0x00007ffff36b1876 in WebCore::ContainerNode::parserAppendChild (this=0x861430, newChild=...) at ../../Source/WebCore/dom/ContainerNode.cpp:761 #7 0x00007ffff39cdaba in WebCore::insert (task=...) at ../../Source/WebCore/html/parser/HTMLConstructionSite.cpp:98 #8 0x00007ffff39cdb13 in WebCore::executeInsertTask (task=...) at ../../Source/WebCore/html/parser/HTMLConstructionSite.cpp:105 #9 0x00007ffff39cdd19 in WebCore::executeTask (task=...) at ../../Source/WebCore/html/parser/HTMLConstructionSite.cpp:143 #10 0x00007ffff39ce03e in WebCore::HTMLConstructionSite::executeQueuedTasks (this=0x9a08c8) at ../../Source/WebCore/html/parser/HTMLConstructionSite.cpp:193 #11 0x00007ffff39fcb64 in WebCore::HTMLTreeBuilder::constructTree (this=0x9a08b0, token=0x7fffffffd210) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:366 #12 0x00007ffff39d6546 in WebCore::HTMLDocumentParser::constructTreeFromHTMLToken (this=0x9eb840, rawToken=...) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:356 #13 0x00007ffff39d6189 in WebCore::HTMLDocumentParser::pumpTokenizer (this=0x9eb840, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:309 #14 0x00007ffff39d597f in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible (this=0x9eb840, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:189 #15 0x00007ffff39d6b11 in WebCore::HTMLDocumentParser::append (this=0x9eb840, inputSource=...) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:440 #16 0x00007ffff36c72cf in WebCore::DecodedDataDocumentParser::flush (this=0x9eb840, writer=...) at ../../Source/WebCore/dom/DecodedDataDocumentParser.cpp:60 #17 0x00007ffff3b1e029 in WebCore::DocumentWriter::end (this=0xac1890) at ../../Source/WebCore/loader/DocumentWriter.cpp:247 #18 0x00007ffff3b0b0b7 in WebCore::DocumentLoader::finishedLoading (this=0xac17f0, finishTime=0) at ../../Source/WebCore/loader/DocumentLoader.cpp:441 #19 0x00007ffff3b0ae20 in WebCore::DocumentLoader::notifyFinished (this=0xac17f0, resource=0x8576b0) at ../../Source/WebCore/loader/DocumentLoader.cpp:375 #20 0x00007ffff3bb199b in WebCore::CachedResource::checkNotify (this=0x8576b0) at ../../Source/WebCore/loader/cache/CachedResource.cpp:334 #21 0x00007ffff3bb1a82 in WebCore::CachedResource::finishLoading (this=0x8576b0) at ../../Source/WebCore/loader/cache/CachedResource.cpp:350 #22 0x00007ffff3baea21 in WebCore::CachedRawResource::finishLoading (this=0x8576b0, data=0x7d5db0) at ../../Source/WebCore/loader/cache/CachedRawResource.cpp:101 #23 0x00007ffff3b654ae in WebCore::SubresourceLoader::didFinishLoading (this=0x857c10, finishTime=0) at ../../Source/WebCore/loader/SubresourceLoader.cpp:310 #24 0x00007ffff3b6199b in WebCore::ResourceLoader::didFinishLoading (this=0x857c10, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:518 #25 0x00007ffff441bf5b in WebCore::readCallback (asyncResult=0x99f9f0, data=0x858640) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1302 #26 0x00007fffee5732ea in async_ready_callback_wrapper (source_object=0xa59b30, res=0x99f9f0, user_data=0x858640) at ginputstream.c:519 #27 0x00007fffee592ceb in g_task_return_now (task=0x99f9f0) at gtask.c:1108 #28 0x00007fffee592d09 in complete_in_idle_cb (task=0x99f9f0) at gtask.c:1117 #29 0x00007fffee8c22e6 in g_main_dispatch (context=0x744bc0) at gmain.c:3065 #30 g_main_context_dispatch (context=context@entry=0x744bc0) at gmain.c:3641 #31 0x00007fffee8c2638 in g_main_context_iterate (context=0x744bc0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3712 #32 0x00007fffee8c2a3a in g_main_loop_run (loop=0x7bd010) at gmain.c:3906 #33 0x00007ffff4a67850 in WTF::RunLoop::run () at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:59 #34 0x00007ffff321d850 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffda58) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61 #35 0x00007ffff321d6b5 in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffda58) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:73 #36 0x000000000044c28d in main (argc=2, argv=0x7fffffffda58) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:32 1028503 1 236442 rhodovan.u-szeged 2014-08-12 05:49:05 -0700 Created attachment 236442 Proposed patch 1028617 2 236442 darin 2014-08-12 14:57:31 -0700 Comment on attachment 236442 Proposed patch View in context: https://bugs.webkit.org/attachment.cgi?id=236442&action=review > Source/WebCore/svg/animation/SVGSMILElement.cpp:308 > + if (!ok || !SMILTime(result).isFinite()) Seems fine, but don’t we also want to reject negative numbers? Also, I see the code to construct an SMILTime rejects NaN. What prevents toDouble from returning NaN? 1028627 3 236442 commit-queue 2014-08-12 15:30:49 -0700 Comment on attachment 236442 Proposed patch Clearing flags on attachment: 236442 Committed r172496: <http://trac.webkit.org/changeset/172496> 1028628 4 commit-queue 2014-08-12 15:30:54 -0700 All reviewed patches have been landed. Closing bug. 1029732 5 rhodovan.u-szeged 2014-08-18 01:57:28 -0700 (In reply to comment #2) > (From update of attachment 236442 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=236442&action=review > > > Source/WebCore/svg/animation/SVGSMILElement.cpp:308 > > + if (!ok || !SMILTime(result).isFinite()) > > Seems fine, but don’t we also want to reject negative numbers? Negative values are valid for representing animation offsets: http://www.w3.org/TR/SVG/animate.html#OffsetValueSyntax > Also, I see the code to construct an SMILTime rejects NaN. What prevents toDouble from returning NaN? If the given value is not a number than toDouble sets the |ok| flag to false to indicate that something went wrong and the result will be set to unresolved. 236442 2014-08-12 05:49:05 -0700 2014-08-12 15:30:49 -0700 Proposed patch 0001-fix.patch text/plain 4679 rhodovan.u-szeged RnJvbSA4NTE2YWVhNTA2MGIwNDAwOTA5ZGY0ZWZhNmUwNmYxMWZkMTVkMDZhIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBSZW5hdGEgSG9kb3ZhbiA8cmhvZG92YW4udS1zemVnZWRAcGFy dG5lci5zYW1zdW5nLmNvbT4KRGF0ZTogVHVlLCAxMiBBdWcgMjAxNCAxNDo0NzoyMyArMDIwMApT dWJqZWN0OiBbUEFUQ0hdIGZpeAoKLS0tCiBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHwgMTAgKysrKysrKysrKwogLi4udGVNb3Rpb24tY3Jhc2gt d2l0aC1sYXJnZS1iZWdpbi10aW1lLWV4cGVjdGVkLnR4dCB8ICAxICsKIC4uLi9hbmltYXRlTW90 aW9uLWNyYXNoLXdpdGgtbGFyZ2UtYmVnaW4tdGltZS5odG1sICAgfCAxNSArKysrKysrKysrKysr KysKIFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAg fCAyMCArKysrKysrKysrKysrKysrKysrKwogU291cmNlL1dlYkNvcmUvc3ZnL2FuaW1hdGlvbi9T VkdTTUlMRWxlbWVudC5jcHAgICAgICB8ICA0ICsrLS0KIDUgZmlsZXMgY2hhbmdlZCwgNDggaW5z ZXJ0aW9ucygrKSwgMiBkZWxldGlvbnMoLSkKIGNyZWF0ZSBtb2RlIDEwMDY0NCBMYXlvdXRUZXN0 cy9zdmcvYW5pbWF0aW9ucy9hbmltYXRlTW90aW9uLWNyYXNoLXdpdGgtbGFyZ2UtYmVnaW4tdGlt ZS1leHBlY3RlZC50eHQKIGNyZWF0ZSBtb2RlIDEwMDY0NCBMYXlvdXRUZXN0cy9zdmcvYW5pbWF0 aW9ucy9hbmltYXRlTW90aW9uLWNyYXNoLXdpdGgtbGFyZ2UtYmVnaW4tdGltZS5odG1sCgpkaWZm IC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmlu ZGV4IGVhN2U4NGUuLjY4MWZhZDAgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZwor KysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxMyBAQAorMjAxNC0wOC0xMiAg UmVuYXRhIEhvZG92YW4gIDxyaG9kb3Zhbi51LXN6ZWdlZEBwYXJ0bmVyLnNhbXN1bmcuY29tPgor CisgICAgICAgIE1ha2Ugc3VyZSB0aGF0IGJlZ2luIHRpbWUgY2Fubm90IGJlIGdyZWF0ZXIgdGhh biBTTUlMVGltZTo6aW5kZWZpbml0ZVZhbHVlIHVuaW50ZW50aW9uYWxseS4KKyAgICAgICAgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzNTgzOAorCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogc3ZnL2FuaW1hdGlvbnMvYW5p bWF0ZU1vdGlvbi1jcmFzaC13aXRoLWxhcmdlLWJlZ2luLXRpbWUtZXhwZWN0ZWQudHh0OiBBZGRl ZC4KKyAgICAgICAgKiBzdmcvYW5pbWF0aW9ucy9hbmltYXRlTW90aW9uLWNyYXNoLXdpdGgtbGFy Z2UtYmVnaW4tdGltZS5odG1sOiBBZGRlZC4KKwogMjAxNC0wOC0xMSAgQnJlbnQgRnVsZ2hhbSAg PGJmdWxnaGFtQGFwcGxlLmNvbT4KIAogICAgICAgICBbTWFjLCBpT1NdIFNvbWUgbWVkaWEgY29u dGVudCBuZXZlciByZWFjaGVzIGZ1bGwgJ2xvYWRlZCcgc3RhdGUKZGlmZiAtLWdpdCBhL0xheW91 dFRlc3RzL3N2Zy9hbmltYXRpb25zL2FuaW1hdGVNb3Rpb24tY3Jhc2gtd2l0aC1sYXJnZS1iZWdp bi10aW1lLWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3RzL3N2Zy9hbmltYXRpb25zL2FuaW1hdGVN b3Rpb24tY3Jhc2gtd2l0aC1sYXJnZS1iZWdpbi10aW1lLWV4cGVjdGVkLnR4dApuZXcgZmlsZSBt b2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi5hMDk0MGQyCi0tLSAvZGV2L251bGwKKysrIGIvTGF5 b3V0VGVzdHMvc3ZnL2FuaW1hdGlvbnMvYW5pbWF0ZU1vdGlvbi1jcmFzaC13aXRoLWxhcmdlLWJl Z2luLXRpbWUtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEgQEAKK1BBU1MgaWYgV2ViS2l0IGRvZXMg bm90IGNyYXNoIGluIGRlYnVnLgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvc3ZnL2FuaW1hdGlv bnMvYW5pbWF0ZU1vdGlvbi1jcmFzaC13aXRoLWxhcmdlLWJlZ2luLXRpbWUuaHRtbCBiL0xheW91 dFRlc3RzL3N2Zy9hbmltYXRpb25zL2FuaW1hdGVNb3Rpb24tY3Jhc2gtd2l0aC1sYXJnZS1iZWdp bi10aW1lLmh0bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uYTEzNzcxNAot LS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL3N2Zy9hbmltYXRpb25zL2FuaW1hdGVNb3Rp b24tY3Jhc2gtd2l0aC1sYXJnZS1iZWdpbi10aW1lLmh0bWwKQEAgLTAsMCArMSwxNSBAQAorPCFE T0NUWVBFIGh0bWw+Cis8c3ZnIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+Cisg ICAgPGFuaW1hdGVNb3Rpb24gYmVnaW49IjY4OTMyODIwNzgzNDM2NTEwOTQwMzc4NjU5MzMzMjc1 MzE0ODAyNHMiLz4KKzwvc3ZnPgorPHA+UEFTUyBpZiBXZWJLaXQgZG9lcyBub3QgY3Jhc2ggaW4g ZGVidWcuPC9wPgorPHNjcmlwdD4KK2lmICh3aW5kb3cudGVzdFJ1bm5lcikgeworICAgIHRlc3RS dW5uZXIud2FpdFVudGlsRG9uZSgpOworICAgIHRlc3RSdW5uZXIuZHVtcEFzVGV4dCgpOworCisg ICAgd2luZG93Lm9ubG9hZCA9IGZ1bmN0aW9uKCkgeworICAgICAgICB0ZXN0UnVubmVyLm5vdGlm eURvbmUoKTsKKyAgICB9OworfQorPC9zY3JpcHQ+CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29y ZS9DaGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMzBmMWU1YS4uYTU1 ODMwMCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9X ZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIzIEBACisyMDE0LTA4LTEyICBSZW5hdGEgSG9k b3ZhbiAgPHJob2RvdmFuLnUtc3plZ2VkQHBhcnRuZXIuc2Ftc3VuZy5jb20+CisKKyAgICAgICAg TWFrZSBzdXJlIHRoYXQgYmVnaW4gdGltZSBjYW5ub3QgYmUgZ3JlYXRlciB0aGFuIFNNSUxUaW1l OjppbmRlZmluaXRlVmFsdWUgdW5pbnRlbnRpb25hbGx5LgorICAgICAgICBodHRwczovL2J1Z3Mu d2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTM1ODM4CisKKyAgICAgICAgUmV2aWV3ZWQgYnkg Tk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgV2hlbiBXZWJDb3JlOjpTVkdTTUlMRWxlbWVudDo6 cmVzb2x2ZUludGVydmFsIGNyZWF0ZXMgYSBTTUlMVGltZSBiZWdpbgorICAgICAgICBub2RlIGZv ciBhIFNNSUxJbnRlcnZhbCwgdGhlbiBpdCBvbmx5IGNoZWNrcyBpZiB0aGUgdmFsdWUgb2YgYmVn aW4gaXMKKyAgICAgICAgaW5kZWZpbml0ZSBvciB1bnJlc29sdmVkIGJ1dCBtaXNzZXMgdGhlIGNh c2UgaWYgaXQgaXMgYmV0d2VlbiB0aGVzZSB0d28KKyAgICAgICAgcmVmZXJlbmNlIHZhbHVlcy4K KworICAgICAgICBUaGlzIGlzIGEgYmFja3BvcnQgb2YgbXkgZml4IGluIEJsaW5rOiBodHRwczov L2NvZGVyZXZpZXcuY2hyb21pdW0ub3JnLzQwNjI2MzAwMi8uCisKKyAgICAgICAgVGVzdDogc3Zn L2FuaW1hdGlvbnMvYW5pbWF0ZU1vdGlvbi1jcmFzaC13aXRoLWxhcmdlLWJlZ2luLXRpbWUuaHRt bAorCisgICAgICAgICogc3ZnL2FuaW1hdGlvbi9TVkdTTUlMRWxlbWVudC5jcHA6CisgICAgICAg IChXZWJDb3JlOjpTVkdTTUlMRWxlbWVudDo6cGFyc2VPZmZzZXRWYWx1ZSk6CisgICAgICAgIChX ZWJDb3JlOjpTVkdTTUlMRWxlbWVudDo6cGFyc2VDbG9ja1ZhbHVlKToKKwogMjAxNC0wOC0xMiAg RWR1YXJkbyBMaW1hIE1pdGV2ICA8ZWxpbWFAaWdhbGlhLmNvbT4KICAgICAgICAgW0dUS10gQWRk cyBkZXBlbmRlbmN5IG9uIEdudVRMUyAzLjArIGZvciB0aGUgaW1wbGVtZW50YXRpb24gb2Ygc3Vi dGxlIGNyeXB0byBhbGdvcml0aG1zCiAgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3No b3dfYnVnLmNnaT9pZD0xMzMzMTcKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3N2Zy9hbmlt YXRpb24vU1ZHU01JTEVsZW1lbnQuY3BwIGIvU291cmNlL1dlYkNvcmUvc3ZnL2FuaW1hdGlvbi9T VkdTTUlMRWxlbWVudC5jcHAKaW5kZXggOGZhMjk0ZS4uY2I0MzhhOCAxMDA2NDQKLS0tIGEvU291 cmNlL1dlYkNvcmUvc3ZnL2FuaW1hdGlvbi9TVkdTTUlMRWxlbWVudC5jcHAKKysrIGIvU291cmNl L1dlYkNvcmUvc3ZnL2FuaW1hdGlvbi9TVkdTTUlMRWxlbWVudC5jcHAKQEAgLTMwNSw3ICszMDUs NyBAQCBTTUlMVGltZSBTVkdTTUlMRWxlbWVudDo6cGFyc2VPZmZzZXRWYWx1ZShjb25zdCBTdHJp bmcmIGRhdGEpCiAgICAgICAgIHJlc3VsdCA9IHBhcnNlLmxlZnQocGFyc2UubGVuZ3RoKCkgLSAx KS50b0RvdWJsZSgmb2spOwogICAgIGVsc2UKICAgICAgICAgcmVzdWx0ID0gcGFyc2UudG9Eb3Vi bGUoJm9rKTsKLSAgICBpZiAoIW9rKQorICAgIGlmICghb2sgfHwgIVNNSUxUaW1lKHJlc3VsdCku aXNGaW5pdGUoKSkKICAgICAgICAgcmV0dXJuIFNNSUxUaW1lOjp1bnJlc29sdmVkKCk7CiAgICAg cmV0dXJuIHJlc3VsdDsKIH0KQEAgLTM0MSw3ICszNDEsNyBAQCBTTUlMVGltZSBTVkdTTUlMRWxl bWVudDo6cGFyc2VDbG9ja1ZhbHVlKGNvbnN0IFN0cmluZyYgZGF0YSkKICAgICB9IGVsc2UKICAg ICAgICAgcmV0dXJuIHBhcnNlT2Zmc2V0VmFsdWUocGFyc2UpOwogCi0gICAgaWYgKCFvaykKKyAg ICBpZiAoIW9rIHx8ICFTTUlMVGltZShyZXN1bHQpLmlzRmluaXRlKCkpCiAgICAgICAgIHJldHVy biBTTUlMVGltZTo6dW5yZXNvbHZlZCgpOwogICAgIHJldHVybiByZXN1bHQ7CiB9Ci0tIAoxLjgu My4yCgo=