149458 2015-09-22 05:58:44 -0700 ASSERTION FAILED: textRenderer->parent() in WebCore::SVGTextLayoutEngineBaseline::dominantBaselineToAlignmentBaseline 2015-11-10 06:20:10 -0800 1 1 1 Unclassified WebKit Layout and Rendering WebKit Local Build Unspecified Unspecified RESOLVED DUPLICATE 127345 P2 Normal --- 116980 1 rhodovan.u-szeged webkit-unassigned darin krit sabouhallawa oldest_to_newest 1127989 0 261740 rhodovan.u-szeged 2015-09-22 05:58:44 -0700 Created attachment 261740 Test Load this test with debug WebKit: <!DOCTYPE html> <style> * { white-space: pre; dominant-baseline: no-change; } </style> <svg> <text>a</text> <tspan></tspan> </svg> The same issue in Blink: crbug.com/534796 Backtrace: ASSERTION FAILED: textRenderer->parent() ../../Source/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp(64) : WebCore::EAlignmentBaseline WebCore::SVGTextLayoutEngineBaseline::dominantBaselineToAlignmentBaseline(bool, const WebCore::RenderObject*) const Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fff8effd700 (LWP 13173)] 0x00007fffec64eab6 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 321 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007fffec64eab6 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 #1 0x00007ffff35c54c9 in WebCore::SVGTextLayoutEngineBaseline::dominantBaselineToAlignmentBaseline (this=0x7fffffff9de0, isVerticalText=false, textRenderer= 0x7fffd5ae9228) at ../../Source/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp:64 #2 0x00007ffff35c5566 in WebCore::SVGTextLayoutEngineBaseline::dominantBaselineToAlignmentBaseline (this=0x7fffffff9de0, isVerticalText=false, textRenderer=0x7fffd5bde450) at ../../Source/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp:81 #3 0x00007ffff35c5566 in WebCore::SVGTextLayoutEngineBaseline::dominantBaselineToAlignmentBaseline (this=0x7fffffff9de0, isVerticalText=false, textRenderer=0x7fffd5bde508) at ../../Source/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp:81 #4 0x00007ffff35c5566 in WebCore::SVGTextLayoutEngineBaseline::dominantBaselineToAlignmentBaseline (this=0x7fffffff9de0, isVerticalText=false, textRenderer=0x7fffd5aea178) at ../../Source/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp:81 #5 0x00007ffff35c5566 in WebCore::SVGTextLayoutEngineBaseline::dominantBaselineToAlignmentBaseline (this=0x7fffffff9de0, isVerticalText=false, textRenderer=0x7fffd5ab5000) at ../../Source/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp:81 #6 0x00007ffff35c5673 in WebCore::SVGTextLayoutEngineBaseline::calculateAlignmentBaselineShift (this=0x7fffffff9de0, isVerticalText=false, textRenderer=...) at ../../Source/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp:113 #7 0x00007ffff35c3480 in WebCore::SVGTextLayoutEngine::layoutTextOnLineOrPath (this=0x7fffffffa1d0, textBox=..., text=..., style=...) at ../../Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp:432 #8 0x00007ffff35c2a54 in WebCore::SVGTextLayoutEngine::layoutInlineTextBox (this=0x7fffffffa1d0, textBox=...) at ../../Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp:224 #9 0x00007ffff35b857c in WebCore::SVGRootInlineBox::layoutCharactersInTextBoxes (this=0x7fffd5bb3c60, start=0x7fffd5bb3c60, characterLayout=...) at ../../Source/WebCore/rendering/svg/SVGRootInlineBox.cpp:108 #10 0x00007ffff35b8415 in WebCore::SVGRootInlineBox::computePerCharacterLayoutInformation (this=0x7fffd5bb3c60) at ../../Source/WebCore/rendering/svg/SVGRootInlineBox.cpp:91 #11 0x00007ffff3302b75 in WebCore::RenderBlockFlow::createLineBoxesFromBidiRuns (this=0x7fffd5ab5000, bidiLevel=0, bidiRuns=..., end=..., lineInfo=..., verticalPositionCache=..., trailingSpaceRun=0x0, wordMeasurements=...) at ../../Source/WebCore/rendering/RenderBlockLineLayout.cpp:1131 #12 0x00007ffff3303a6e in WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange (this=0x7fffd5ab5000, layoutState=..., resolver=..., cleanLineStart=..., cleanLineBidiStatus=..., consecutiveHyphenatedLines=0) at ../../Source/WebCore/rendering/RenderBlockLineLayout.cpp:1306 #13 0x00007ffff3303122 in WebCore::RenderBlockFlow::layoutRunsAndFloats (this=0x7fffd5ab5000, layoutState=..., hasInlineChild=true) at ../../Source/WebCore/rendering/RenderBlockLineLayout.cpp:1214 #14 0x00007ffff3305a6c in WebCore::RenderBlockFlow::layoutLineBoxes (this=0x7fffd5ab5000, relayoutChildren=true, repaintLogicalTop=..., repaintLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockLineLayout.cpp:1644 #15 0x00007ffff32e2ebd in WebCore::RenderBlockFlow::layoutInlineChildren (this=0x7fffd5ab5000, relayoutChildren=true, repaintLogicalTop=..., repaintLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:651 #16 0x00007ffff3598951 in WebCore::RenderSVGText::layout (this=0x7fffd5ab5000) at ../../Source/WebCore/rendering/svg/RenderSVGText.cpp:407 #17 0x00007ffff35a5903 in WebCore::SVGRenderSupport::layoutChildren (start=..., selfNeedsLayout=true) at ../../Source/WebCore/rendering/svg/SVGRenderSupport.cpp:276 #18 0x00007ffff358fef9 in WebCore::RenderSVGRoot::layout (this=0x7fffd5aea178) at ../../Source/WebCore/rendering/svg/RenderSVGRoot.cpp:179 #19 0x00007ffff327d31f in WebCore::RenderElement::layoutIfNeeded (this=0x7fffd5aea178) at ../../Source/WebCore/rendering/RenderElement.h:135 #20 0x00007ffff3305a2a in WebCore::RenderBlockFlow::layoutLineBoxes (this=0x7fffd5bde508, relayoutChildren=true, repaintLogicalTop=..., repaintLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockLineLayout.cpp:1642 #21 0x00007ffff32e2ebd in WebCore::RenderBlockFlow::layoutInlineChildren (this=0x7fffd5bde508, relayoutChildren=true, repaintLogicalTop=..., repaintLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:651 #22 0x00007ffff32e2203 in WebCore::RenderBlockFlow::layoutBlock (this=0x7fffd5bde508, relayoutChildren=true, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:483 #23 0x00007ffff32b5922 in WebCore::RenderBlock::layout (this=0x7fffd5bde508) at ../../Source/WebCore/rendering/RenderBlock.cpp:926 #24 0x00007ffff32e3284 in WebCore::RenderBlockFlow::layoutBlockChild (this=0x7fffd5bde450, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:709 #25 0x00007ffff32e2dc3 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x7fffd5bde450, relayoutChildren=true, maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:632 #26 0x00007ffff32e2227 in WebCore::RenderBlockFlow::layoutBlock (this=0x7fffd5bde450, relayoutChildren=true, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:485 #27 0x00007ffff32b5922 in WebCore::RenderBlock::layout (this=0x7fffd5bde450) at ../../Source/WebCore/rendering/RenderBlock.cpp:926 ---Type <return> to continue, or q <return> to quit--- #28 0x00007ffff32e3284 in WebCore::RenderBlockFlow::layoutBlockChild (this=0x7fffd5ae9228, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:709 #29 0x00007ffff32e2dc3 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x7fffd5ae9228, relayoutChildren=true, maxFloatLogicalBottom=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:632 #30 0x00007ffff32e2227 in WebCore::RenderBlockFlow::layoutBlock (this=0x7fffd5ae9228, relayoutChildren=true, pageLogicalHeight=...) at ../../Source/WebCore/rendering/RenderBlockFlow.cpp:485 #31 0x00007ffff32b5922 in WebCore::RenderBlock::layout (this=0x7fffd5ae9228) at ../../Source/WebCore/rendering/RenderBlock.cpp:926 #32 0x00007ffff34cbc39 in WebCore::RenderView::layoutContent (this=0x7fffd5ae9228, state=...) at ../../Source/WebCore/rendering/RenderView.cpp:253 #33 0x00007ffff34cc32c in WebCore::RenderView::layout (this=0x7fffd5ae9228) at ../../Source/WebCore/rendering/RenderView.cpp:378 #34 0x00007ffff2fe43bd in WebCore::FrameView::layout (this=0x7fffd5811000, allowSubtree=true) at ../../Source/WebCore/page/FrameView.cpp:1409 #35 0x00007ffff29175c6 in WebCore::Document::implicitClose (this=0x7fffd5826140) at ../../Source/WebCore/dom/Document.cpp:2699 #36 0x00007ffff2e79385 in WebCore::FrameLoader::checkCallImplicitClose (this=0x7fffd5af0098) at ../../Source/WebCore/loader/FrameLoader.cpp:891 #37 0x00007ffff2e790bc in WebCore::FrameLoader::checkCompleted (this=0x7fffd5af0098) at ../../Source/WebCore/loader/FrameLoader.cpp:837 #38 0x00007ffff2e78e2c in WebCore::FrameLoader::finishedParsing (this=0x7fffd5af0098) at ../../Source/WebCore/loader/FrameLoader.cpp:758 #39 0x00007ffff29215fa in WebCore::Document::finishedParsing (this=0x7fffd5826140) at ../../Source/WebCore/dom/Document.cpp:4898 #40 0x00007ffff2cccb33 in WebCore::HTMLConstructionSite::finishedParsing (this=0x7fffd5af8920) at ../../Source/WebCore/html/parser/HTMLConstructionSite.cpp:404 #41 0x00007ffff2d0c38a in WebCore::HTMLTreeBuilder::finished (this=0x7fffd5af8900) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2937 #42 0x00007ffff2cd5c90 in WebCore::HTMLDocumentParser::end (this=0x7fffd58165c0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:402 #43 0x00007ffff2cd5d5e in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd (this=0x7fffd58165c0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:411 #44 0x00007ffff2cd497b in WebCore::HTMLDocumentParser::prepareToStopParsing (this=0x7fffd58165c0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:132 #45 0x00007ffff2cd5d95 in WebCore::HTMLDocumentParser::attemptToEnd (this=0x7fffd58165c0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:423 #46 0x00007ffff2cd5e43 in WebCore::HTMLDocumentParser::finish (this=0x7fffd58165c0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:451 #47 0x00007ffff2e68c78 in WebCore::DocumentWriter::end (this=0x7fffd58360a0) at ../../Source/WebCore/loader/DocumentWriter.cpp:247 #48 0x00007ffff2e5264a in WebCore::DocumentLoader::finishedLoading (this=0x7fffd5836000, finishTime=0) at ../../Source/WebCore/loader/DocumentLoader.cpp:430 #49 0x00007ffff2e523a8 in WebCore::DocumentLoader::notifyFinished (this=0x7fffd5836000, resource=0x7fffd580f9c0) at ../../Source/WebCore/loader/DocumentLoader.cpp:377 #50 0x00007ffff2f10f7d in WebCore::CachedResource::checkNotify (this=0x7fffd580f9c0) at ../../Source/WebCore/loader/cache/CachedResource.cpp:297 #51 0x00007ffff2f1108c in WebCore::CachedResource::finishLoading (this=0x7fffd580f9c0) at ../../Source/WebCore/loader/cache/CachedResource.cpp:313 #52 0x00007ffff2f0d28a in WebCore::CachedRawResource::finishLoading (this=0x7fffd580f9c0, data=0x7fffd5bfde80) at ../../Source/WebCore/loader/cache/CachedRawResource.cpp:103 #53 0x00007ffff2ebd812 in WebCore::SubresourceLoader::didFinishLoading (this=0x7fffd5836c00, finishTime=0) at ../../Source/WebCore/loader/SubresourceLoader.cpp:372 #54 0x00007ffff2eb828b in WebCore::ResourceLoader::didFinishLoading (this=0x7fffd5836c00, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:631 #55 0x00007ffff38e70f6 in WebCore::readCallback (asyncResult=0xb2e9b0, data=0x7fffd5bb6300) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1340 #56 0x00007fffe945796a in async_ready_callback_wrapper (source_object=0xa35db0, res=0xb2e9b0, user_data=0x7fffd5bb6300) at ginputstream.c:529 #57 0x00007fffe947d453 in g_task_return_now (task=0xb2e9b0) at gtask.c:1088 #58 0x00007fffe947d489 in complete_in_idle_cb (task=0xb2e9b0) at gtask.c:1102 #59 0x00007fffe8eb7a9d in g_main_dispatch (context=0x49de20) at gmain.c:3122 #60 g_main_context_dispatch (context=context@entry=0x49de20) at gmain.c:3737 #61 0x00007fffe8eb7e70 in g_main_context_iterate (context=0x49de20, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3808 #62 0x00007fffe8eb8192 in g_main_loop_run (loop=0x582200) at gmain.c:4002 #63 0x00007ffff406313f in WTF::RunLoop::run () at ../../Source/WTF/wtf/glib/RunLoopGLib.cpp:67 #64 0x00007ffff2300a23 in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7fffffffd548) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61 #65 0x00007ffff2300880 in WebKit::WebProcessMainUnix (argc=2, argv=0x7fffffffd548) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:77 #66 0x00000000004008da in main (argc=2, argv=0x7fffffffd548) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:44 1140754 1 rhodovan.u-szeged 2015-11-10 06:20:10 -0800 *** This bug has been marked as a duplicate of bug 127345 *** 261740 2015-09-22 05:58:44 -0700 2015-09-22 05:58:44 -0700 Test crash.html text/html 146 rhodovan.u-szeged PCFET0NUWVBFIGh0bWw+CjxzdHlsZT4KKiB7CiAgICB3aGl0ZS1zcGFjZTogcHJlOwogICAgZG9t aW5hbnQtYmFzZWxpbmU6IG5vLWNoYW5nZTsKfQo8L3N0eWxlPgo8c3ZnPgogICAgPHRleHQ+YTwv dGV4dD4KICAgIDx0c3Bhbj48L3RzcGFuPgo8L3N2Zz4=