149302 2015-09-17 15:08:54 -0700 Null dereference loading Blink layout test fast/css/zoom-on-nested-scroll-crash.html 2015-10-16 20:56:08 -0700 1 1 1 Unclassified WebKit Layout and Rendering WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED BlinkMergeCandidate, HasReduction, InRadar P2 Normal --- 1 jhoneycutt jiewen_tan commit-queue esprehn+autocc glenn jiewen_tan kondapallykalyan simon.fraser webkit-bug-importer zalan oldest_to_newest 1126886 0 261436 jhoneycutt 2015-09-17 15:08:54 -0700 Created attachment 261436 crashing test Null dereference loading Blink layout test fast/css/zoom-on-nested-scroll-crash.html. Stack trace: Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000028 Exception Note: EXC_CORPSE_NOTIFY VM Regions Near 0x28: --> __TEXT 000000010bcc8000-000000010bcca000 [ 8K] r-x/rwx SM=COW /Users/USER/*/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.Development.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development Application Specific Information: CRASHING TEST: temp-tests/fast/css/zoom-on-nested-scroll-crash.html Global Trace Buffer (reverse chronological seconds): 57.772360 CFNetwork 0x00007fff88d43b97 Explicitly setting CF cookie storage singleton 57.772701 CFNetwork 0x00007fff88d8f211 Explicitly setting cookie storage singleton Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x000000011450e98b WebCore::RenderBox::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) + 491 (IntPoint.h:69) 1 com.apple.WebCore 0x00000001144de4a1 WebCore::RenderBlock::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) + 145 (RenderObject.h:970) 2 com.apple.WebCore 0x00000001145f2348 WebCore::RenderScrollbarPart::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) + 24 (RenderObject.h:969) 3 com.apple.WebCore 0x0000000114540692 WebCore::RenderElement::setStyle(WTF::Ref<WebCore::RenderStyle>&&, WebCore::StyleDifference) + 594 (RenderElement.h:66) 4 com.apple.WebCore 0x00000001145f0191 WebCore::RenderScrollbar::updateScrollbarPart(WebCore::ScrollbarPart) + 353 (Ref.h:55) 5 com.apple.WebCore 0x00000001145f061e WebCore::RenderScrollbar::updateScrollbarParts() + 30 (RenderScrollbar.cpp:159) 6 com.apple.WebCore 0x0000000114599c09 WebCore::RenderLayer::styleChanged(WebCore::StyleDifference, WebCore::RenderStyle const*) + 985 (RefPtr.h:75) 7 com.apple.WebCore 0x00000001145b3f8e WebCore::RenderLayerModelObject::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) + 542 (RenderLayerModelObject.cpp:160) 8 com.apple.WebCore 0x000000011450e7c2 WebCore::RenderBox::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) + 34 (Ref.h:120) 9 com.apple.WebCore 0x00000001144de4a1 WebCore::RenderBlock::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) + 145 (RenderObject.h:970) 10 com.apple.WebCore 0x00000001144fb49c WebCore::RenderBlockFlow::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) + 28 (RenderObject.h:958) 11 com.apple.WebCore 0x0000000114540692 WebCore::RenderElement::setStyle(WTF::Ref<WebCore::RenderStyle>&&, WebCore::StyleDifference) + 594 (RenderElement.h:66) 12 com.apple.WebCore 0x00000001147f95cf WebCore::Style::resolveTree(WebCore::Element&, WebCore::RenderStyle&, WebCore::RenderTreePosition&, WebCore::Style::Change) + 1711 (Ref.h:55) 13 com.apple.WebCore 0x00000001147f99c2 WebCore::Style::resolveTree(WebCore::Element&, WebCore::RenderStyle&, WebCore::RenderTreePosition&, WebCore::Style::Change) + 2722 (StyleResolveTree.cpp:827) 14 com.apple.WebCore 0x00000001147f99c2 WebCore::Style::resolveTree(WebCore::Element&, WebCore::RenderStyle&, WebCore::RenderTreePosition&, WebCore::Style::Change) + 2722 (StyleResolveTree.cpp:827) 15 com.apple.WebCore 0x00000001147f8f10 WebCore::Style::resolveTree(WebCore::Document&, WebCore::Style::Change) + 336 (StyleResolveTree.cpp:867) 16 com.apple.WebCore 0x0000000113c39f7d WebCore::Document::recalcStyle(WebCore::Style::Change) + 285 (Document.cpp:1864) 17 com.apple.WebCore 0x0000000113c45275 WebCore::Document::finishedParsing() + 405 (Frame.h:327) 18 com.apple.WebCore 0x0000000113e71e05 WebCore::HTMLDocumentParser::prepareToStopParsing() + 165 (RefCounted.h:99) 19 com.apple.WebCore 0x0000000113c7569a WebCore::DocumentWriter::end() + 58 (StdLibExtras.h:366) 20 com.apple.WebCore 0x0000000113c5d9ec WebCore::DocumentLoader::finishedLoading(double) + 268 (ResourceErrorBase.h:42) 21 com.apple.WebCore 0x0000000113a8e179 WebCore::CachedResource::checkNotify() + 153 (CachedResourceClientWalker.h:51) 22 com.apple.WebCore 0x0000000113a8a433 WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) + 227 (CachedRawResource.cpp:104) 23 com.apple.WebCore 0x0000000114805501 WebCore::SubresourceLoader::didFinishLoading(double) + 1153 (ResourceLoader.h:154) 24 com.apple.WebKit 0x000000011234b98d WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::MessageDecoder&) + 561 (HandleMessage.h:16) 25 com.apple.WebKit 0x00000001121251f1 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) + 127 (memory:2636) 26 com.apple.WebKit 0x0000000112127b4a IPC::Connection::dispatchOneMessage() + 126 (memory:2656) 27 com.apple.JavaScriptCore 0x0000000113569985 WTF::RunLoop::performWork() + 437 (functional:1742) 28 com.apple.JavaScriptCore 0x0000000113569d32 WTF::RunLoop::performWork(void*) + 34 (RunLoopCF.cpp:39) 29 com.apple.CoreFoundation 0x00007fff949e2c01 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 30 com.apple.CoreFoundation 0x00007fff949d4b1c __CFRunLoopDoSources0 + 556 31 com.apple.CoreFoundation 0x00007fff949d403f __CFRunLoopRun + 927 32 com.apple.CoreFoundation 0x00007fff949d3a38 CFRunLoopRunSpecific + 296 33 com.apple.HIToolbox 0x00007fff88e673bd RunCurrentEventLoopInMode + 235 34 com.apple.HIToolbox 0x00007fff88e67153 ReceiveNextEventCommon + 432 35 com.apple.HIToolbox 0x00007fff88e66f93 _BlockUntilNextEventMatchingListInModeWithFilter + 71 36 com.apple.AppKit 0x00007fff870b81e7 _DPSNextEvent + 1076 37 com.apple.AppKit 0x00007fff8748490d -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 454 38 com.apple.AppKit 0x00007fff870ae0b8 -[NSApplication run] + 682 39 com.apple.AppKit 0x00007fff87030396 NSApplicationMain + 1176 40 libxpc.dylib 0x00007fff8c70ff70 _xpc_objc_main + 793 41 libxpc.dylib 0x00007fff8c7116bf xpc_main + 494 42 com.apple.WebKit.WebContent.Development 0x000000010bcc9424 main + 409 (XPCServiceMain.Development.mm:187) 43 libdyld.dylib 0x00007fff93aa15ad start + 1 1126887 1 webkit-bug-importer 2015-09-17 15:09:43 -0700 <rdar://problem/22747292> 1131491 2 262663 jiewen_tan 2015-10-07 17:43:40 -0700 Created attachment 262663 Patch 1131686 3 262663 commit-queue 2015-10-08 10:40:41 -0700 Comment on attachment 262663 Patch Clearing flags on attachment: 262663 Committed r190732: <http://trac.webkit.org/changeset/190732> 1131687 4 commit-queue 2015-10-08 10:40:44 -0700 All reviewed patches have been landed. Closing bug. 1134142 5 zalan 2015-10-16 20:56:08 -0700 By looking at the stacktrace, I think what the problem here is that RenderScrollbarPart does not create a render layer (requiresLayer() returns false) while we assume that a box with overflow clip always has a layer. This unexpected behavior will surely show up at other places too. I'd rather check explicitly for scrollbarpart here and assert on layer(), so that we can catch other offenders. 261436 2015-09-17 15:08:54 -0700 2015-09-17 15:08:54 -0700 crashing test zoom-on-nested-scroll-crash.html text/html 459 jhoneycutt PCFET0NUWVBFIGh0bWw+CjxzdHlsZT4KI2VsZW0ge292ZXJmbG93OiBzY3JvbGw7fQojZWxlbTo6 LXdlYmtpdC1zY3JvbGxiYXIge292ZXJmbG93OiBhdXRvO30KPC9zdHlsZT4KPHA+VGVzdCBmb3Ig PGEgaHJlZj0iaHR0cDovL2NyYnVnLmNvbS8yOTEyOTMiPmJ1ZyAyOTEyOTM8L2E+LjwvcD4KPHA+ Wm9vbWluZyBpbiAoY3RybCsrKSBzaG91bGQgbm90IGNyYXNoLgpUaGUgdGVzdCBQQVNTRVMgaWYg aXQgZGlkIG5vdCBjcmFzaC48L3A+CjxkaXYgaWQ9ImVsZW0iPjwvZGl2Pgo8c2NyaXB0PgppZiAo d2luZG93LnRlc3RSdW5uZXIpCiAgICB0ZXN0UnVubmVyLmR1bXBBc1RleHQoKTsKaWYgKHdpbmRv dy5ldmVudFNlbmRlcikKICAgIGV2ZW50U2VuZGVyLnpvb21QYWdlSW4oKTsKZG9jdW1lbnQuZ2V0 RWxlbWVudEJ5SWQoJ2VsZW0nKS5zdHlsZS5zZXRQcm9wZXJ0eSgnem9vbScsIDIpOwo8L3Njcmlw dD4K 262663 2015-10-07 17:43:40 -0700 2015-10-08 10:40:41 -0700 Patch bug-149302-20151007174309.patch text/plain 3745 jiewen_tan U3VidmVyc2lvbiBSZXZpc2lvbjogMTkwMzY2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZGIyYjM5YWRkYjVjMDY5 MmQ2YmRkY2JlZGFiNjEwNTQzMjUwNDNiZC4uZmU4ZGUzNzUyYTk5ZWNiYWJlOTg5MTliYjJjZWNi ZDZhMjQ0YjhjMSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE5IEBACisyMDE1LTEwLTA3ICBKaWV3 ZW4gVGFuICA8amlld2VuX3RhbkBhcHBsZS5jb20+CisKKyAgICAgICAgQWRkIE5VTEwgY2hlY2sg Zm9yIHJlbmRlckJveDo6bGF5ZXIoKSBvbiBhcHBseWluZyB6b29tIGxldmVsIGNoYW5nZQorICAg ICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTQ5MzAyCisgICAg ICAgIDxyZGFyOi8vcHJvYmxlbS8yMjc0NzI5Mj4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICBUZXN0OiBmYXN0L2Nzcy96b29tLW9uLW5lc3RlZC1zY3Jv bGwtY3Jhc2guaHRtbAorCisgICAgICAgIFRoaXMgaXMgYSBtZXJnZSBvZiBCbGluayByMTU4MjM4 OgorICAgICAgICBodHRwczovL2Nocm9taXVtY29kZXJldmlldy5hcHBzcG90LmNvbS8yMzUyNjA4 MQorCisgICAgICAgICogcmVuZGVyaW5nL1JlbmRlckJveC5jcHA6CisgICAgICAgIChXZWJDb3Jl OjpSZW5kZXJCb3g6OnN0eWxlRGlkQ2hhbmdlKToKKwogMjAxNS0wOS0zMCAgQ2hyaXMgRHVtZXog IDxjZHVtZXpAYXBwbGUuY29tPgogCiAgICAgICAgIFVucmV2aWV3ZWQsIHJvbGwgb3V0IHIxODgz MzE6ICJOZXR3b3JrUHJvY2VzczogRE5TIHByZWZldGNoIGhhcHBlbnMgaW4gdGhlIFdlYiBQcm9j ZXNzIgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckJveC5jcHAg Yi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQm94LmNwcAppbmRleCBkMThmYmJkNDA0 MWRlOTNlMjNkNmRlMjg2YTM1YmY0OTdjODY1YjUzLi5mZjdjMjZjMmJjYWM2NGFjMjEwYzkwMjhj MGVlNWM3ZDU4M2ZmNzI2IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVu ZGVyQm94LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQm94LmNwcApA QCAtMzUyLDcgKzM1Miw3IEBAIHZvaWQgUmVuZGVyQm94OjpzdHlsZURpZENoYW5nZShTdHlsZURp ZmZlcmVuY2UgZGlmZiwgY29uc3QgUmVuZGVyU3R5bGUqIG9sZFN0eWxlCiAKICAgICAvLyBJZiBv dXIgem9vbSBmYWN0b3IgY2hhbmdlcyBhbmQgd2UgaGF2ZSBhIGRlZmluZWQgc2Nyb2xsTGVmdC9U b3AsIHdlIG5lZWQgdG8gYWRqdXN0IHRoYXQgdmFsdWUgaW50byB0aGUKICAgICAvLyBuZXcgem9v bWVkIGNvb3JkaW5hdGUgc3BhY2UuCi0gICAgaWYgKGhhc092ZXJmbG93Q2xpcCgpICYmIG9sZFN0 eWxlICYmIG9sZFN0eWxlLT5lZmZlY3RpdmVab29tKCkgIT0gbmV3U3R5bGUuZWZmZWN0aXZlWm9v bSgpKSB7CisgICAgaWYgKGhhc092ZXJmbG93Q2xpcCgpICYmIG9sZFN0eWxlICYmIG9sZFN0eWxl LT5lZmZlY3RpdmVab29tKCkgIT0gbmV3U3R5bGUuZWZmZWN0aXZlWm9vbSgpICYmIGxheWVyKCkp IHsKICAgICAgICAgaWYgKGludCBsZWZ0ID0gbGF5ZXIoKS0+c2Nyb2xsWE9mZnNldCgpKSB7CiAg ICAgICAgICAgICBsZWZ0ID0gKGxlZnQgLyBvbGRTdHlsZS0+ZWZmZWN0aXZlWm9vbSgpKSAqIG5l d1N0eWxlLmVmZmVjdGl2ZVpvb20oKTsKICAgICAgICAgICAgIGxheWVyKCktPnNjcm9sbFRvWE9m ZnNldChsZWZ0KTsKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRl c3RzL0NoYW5nZUxvZwppbmRleCAwNDUzMjA3ZTkxN2VmZjhjODEwODZjNWU4ZTU4YmE2OGUxZjFh MDk5Li5iYTFjZWU2ZWI4ZTk1MjkxNDgxMGQ4YWY2NzgzYmYzYWJmMWZjNTM0IDEwMDY0NAotLS0g YS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0x LDMgKzEsMTQgQEAKKzIwMTUtMTAtMDcgIEppZXdlbiBUYW4gIDxqaWV3ZW5fdGFuQGFwcGxlLmNv bT4KKworICAgICAgICBBZGQgTlVMTCBjaGVjayBmb3IgcmVuZGVyQm94OjpsYXllcigpIG9uIGFw cGx5aW5nIHpvb20gbGV2ZWwgY2hhbmdlCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn L3Nob3dfYnVnLmNnaT9pZD0xNDkzMDIKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzIyNzQ3Mjky PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogZmFz dC9jc3Mvem9vbS1vbi1uZXN0ZWQtc2Nyb2xsLWNyYXNoLWV4cGVjdGVkLnR4dDogQWRkZWQuCisg ICAgICAgICogZmFzdC9jc3Mvem9vbS1vbi1uZXN0ZWQtc2Nyb2xsLWNyYXNoLmh0bWw6IEFkZGVk LgorCiAyMDE1LTA5LTMwICBUaW1vdGh5IEhvcnRvbiAgPHRpbW90aHlfaG9ydG9uQGFwcGxlLmNv bT4KIAogICAgICAgICBDb21wdXRlIGRvY3VtZW50IG1hcmtlciByZWN0cyBhdCB1c2UgdGltZSBp bnN0ZWFkIG9mIHBhaW50IHRpbWUKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvY3NzL3pv b20tb24tbmVzdGVkLXNjcm9sbC1jcmFzaC1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9mYXN0 L2Nzcy96b29tLW9uLW5lc3RlZC1zY3JvbGwtY3Jhc2gtZXhwZWN0ZWQudHh0Cm5ldyBmaWxlIG1v ZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAu LmQxMDdmZjc2MThmNjhlYmQ3MTdmNTdiODM3YTRlMDEzNzAyMjI3NGMKLS0tIC9kZXYvbnVsbAor KysgYi9MYXlvdXRUZXN0cy9mYXN0L2Nzcy96b29tLW9uLW5lc3RlZC1zY3JvbGwtY3Jhc2gtZXhw ZWN0ZWQudHh0CkBAIC0wLDAgKzEsMyBAQAorWm9vbWluZyBpbiAoY3RybCsrKSBzaG91bGQgbm90 IGNyYXNoLiBUaGUgdGVzdCBQQVNTRVMgaWYgaXQgZGlkIG5vdCBjcmFzaC4KKworCmRpZmYgLS1n aXQgYS9MYXlvdXRUZXN0cy9mYXN0L2Nzcy96b29tLW9uLW5lc3RlZC1zY3JvbGwtY3Jhc2guaHRt bCBiL0xheW91dFRlc3RzL2Zhc3QvY3NzL3pvb20tb24tbmVzdGVkLXNjcm9sbC1jcmFzaC5odG1s Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAuLjdlODk1OWEzZWMxODRkOGJmZGM4NzU5Yzg2MjE5NTczNTRiMjFiMDUKLS0t IC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2Nzcy96b29tLW9uLW5lc3RlZC1zY3Jv bGwtY3Jhc2guaHRtbApAQCAtMCwwICsxLDE1IEBACis8IURPQ1RZUEUgaHRtbD4KKzxzdHlsZT4K KyNlbGVtIHtvdmVyZmxvdzogc2Nyb2xsO30KKyNlbGVtOjotd2Via2l0LXNjcm9sbGJhciB7b3Zl cmZsb3c6IGF1dG87fQorPC9zdHlsZT4KKzxwPlpvb21pbmcgaW4gKGN0cmwrKykgc2hvdWxkIG5v dCBjcmFzaC4KK1RoZSB0ZXN0IFBBU1NFUyBpZiBpdCBkaWQgbm90IGNyYXNoLjwvcD4KKzxkaXYg aWQ9ImVsZW0iPjwvZGl2PgorPHNjcmlwdD4KK2lmICh3aW5kb3cudGVzdFJ1bm5lcikKKyAgICB0 ZXN0UnVubmVyLmR1bXBBc1RleHQoKTsKK2lmICh3aW5kb3cuZXZlbnRTZW5kZXIpCisgICAgZXZl bnRTZW5kZXIuem9vbVBhZ2VJbigpOworZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2VsZW0nKS5z dHlsZS5zZXRQcm9wZXJ0eSgnem9vbScsIDIpOworPC9zY3JpcHQ+Cg==