139048 2014-11-25 09:37:52 -0800 ASSERTION FAILED: !characters.isEmpty() in WebCore::HTMLTreeBuilder::processFakeCharacters 2016-08-04 10:35:40 -0700 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Unspecified Unspecified NEW InRadar P2 Normal --- 116980 1 rhodovan.u-szeged webkit-unassigned bfulgham cdumez darin webkit-bug-importer oldest_to_newest 1051015 0 242200 rhodovan.u-szeged 2014-11-25 09:37:52 -0800 Created attachment 242200 Test case Load this test with debug WebKit: <!DOCTYPE html> <isindex prompt=""> Backtrace: ASSERTION FAILED: !characters.isEmpty() ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp(440) : void WebCore::HTMLTreeBuilder::processFakeCharacters(const WTF::String&) Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fff98c4e700 (LWP 8638)] 0x00007fffedc7ea89 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 321 *(int *)(uintptr_t)0xbbadbeef = 0; #0 0x00007fffedc7ea89 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 #1 0x00007ffff346afed in WebCore::HTMLTreeBuilder::processFakeCharacters (this=0x64dd80, characters=...) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:440 #2 0x00007ffff346b4f9 in WebCore::HTMLTreeBuilder::processIsindexStartTagForInBody (this=0x64dd80, token=0x7fffffffd040) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:482 #3 0x00007ffff346d4a2 in WebCore::HTMLTreeBuilder::processStartTagForInBody (this=0x64dd80, token=0x7fffffffd040) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:823 #4 0x00007ffff346f103 in WebCore::HTMLTreeBuilder::processStartTag (this=0x64dd80, token=0x7fffffffd040) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:1156 #5 0x00007ffff346ad26 in WebCore::HTMLTreeBuilder::processToken (this=0x64dd80, token=0x7fffffffd040) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:383 #6 0x00007ffff346ab58 in WebCore::HTMLTreeBuilder::constructTree (this=0x64dd80, token=0x7fffffffd040) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:355 #7 0x00007ffff3442d4f in WebCore::HTMLDocumentParser::constructTreeFromHTMLToken (this=0x589340, rawToken=...) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:352 #8 0x00007ffff3442985 in WebCore::HTMLDocumentParser::pumpTokenizer (this=0x589340, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:309 #9 0x00007ffff344211d in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible (this=0x589340, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:189 #10 0x00007ffff34432e5 in WebCore::HTMLDocumentParser::append (this=0x589340, inputSource=...) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:428 #11 0x00007ffff30cee21 in WebCore::DecodedDataDocumentParser::flush (this=0x589340, writer=...) at ../../Source/WebCore/dom/DecodedDataDocumentParser.cpp:60 #12 0x00007ffff35ad1bf in WebCore::DocumentWriter::end (this=0x589790) at ../../Source/WebCore/loader/DocumentWriter.cpp:243 #13 0x00007ffff3598f55 in WebCore::DocumentLoader::finishedLoading (this=0x5896f0, finishTime=0) at ../../Source/WebCore/loader/DocumentLoader.cpp:440 #14 0x00007ffff3598cbe in WebCore::DocumentLoader::notifyFinished (this=0x5896f0, resource=0x5a80b0) at ../../Source/WebCore/loader/DocumentLoader.cpp:374 #15 0x00007ffff364974c in WebCore::CachedResource::checkNotify (this=0x5a80b0) at ../../Source/WebCore/loader/cache/CachedResource.cpp:293 #16 0x00007ffff364984a in WebCore::CachedResource::finishLoading (this=0x5a80b0) at ../../Source/WebCore/loader/cache/CachedResource.cpp:309 #17 0x00007ffff3645f3f in WebCore::CachedRawResource::finishLoading (this=0x5a80b0, data=0x906c60) at ../../Source/WebCore/loader/cache/CachedRawResource.cpp:104 #18 0x00007ffff35f9c5a in WebCore::SubresourceLoader::didFinishLoading (this=0x5a4d40, finishTime=0) at ../../Source/WebCore/loader/SubresourceLoader.cpp:307 #19 0x00007ffff35f5a3f in WebCore::ResourceLoader::didFinishLoading (this=0x5a4d40, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:502 #20 0x00007ffff3f9e209 in WebCore::readCallback (asyncResult=0x6a91d0, data=0x5a5250) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1300 #21 0x00007fffeb8997d6 in async_ready_callback_wrapper (source_object=0x7c66d0, res=0x6a91d0, user_data=user_data@entry=0x5a5250) at ginputstream.c:523 #22 0x00007fffeb8bf0d5 in g_task_return_now (task=0x6a91d0) at gtask.c:1077 #23 0x00007fffeb8bf0f9 in complete_in_idle_cb (task=0x6a91d0) at gtask.c:1086 #24 0x00007fffeaafea2d in g_main_dispatch (context=0x478020) at gmain.c:3064 #25 g_main_context_dispatch (context=context@entry=0x478020) at gmain.c:3663 #26 0x00007fffeaafed98 in g_main_context_iterate (context=0x478020, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3734 #27 0x00007fffeaaff05a in g_main_loop_run (loop=0x9015f0) at gmain.c:3928 #28 0x00007ffff464b42e in WTF::RunLoop::run () at ../../Source/WTF/wtf/gtk/RunLoopGtk.cpp:59 #29 0x00007ffff2bb8250 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffd968) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61 #30 0x00007ffff2bb80b5 in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffd968) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:73 #31 0x0000000000400891 in main (argc=2, argv=0x7fffffffd968) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:44 1217461 1 bfulgham 2016-08-04 10:35:26 -0700 Problem reproduces under r204037. 1217462 2 webkit-bug-importer 2016-08-04 10:35:40 -0700 <rdar://problem/27702410> 242200 2014-11-25 09:37:52 -0800 2014-11-25 09:37:52 -0800 Test case crash.html text/html 35 rhodovan.u-szeged PCFET0NUWVBFIGh0bWw+Cjxpc2luZGV4IHByb21wdD0iIj4=