15008 2007-08-19 07:49:27 -0700 ASSERTION FAILED: !firstLineBox() == !lastLineBox() setting content on image 2007-08-19 11:34:06 -0700 1 1 1 Unclassified WebKit Layout and Rendering 523.x (Safari 3) Mac OS X 10.4 RESOLVED FIXED http://macrabbit.com/webkit-bugs/img-content/ HasReduction, InRadar P1 Major --- 1 misc mitz dev+webkit mitz oldest_to_newest 1997 0 misc 2007-08-19 07:49:27 -0700 Safari will always crash when visiting this page: http://macrabbit.com/webkit-bugs/img-content/ Crash report: http://macrabbit.com/webkit-bugs/img-content/CrashReport.crash.log Note from user: http://macrabbit.com/webkit-bugs/img-content/CrashReport.note 1992 1 misc 2007-08-19 07:50:18 -0700 *** Bug 15007 has been marked as a duplicate of this bug. *** 1985 2 ddkilzer 2007-08-19 09:23:57 -0700 <rdar://problem/5421397> 1986 3 dev+webkit 2007-08-19 09:30:48 -0700 Confirmed with r25142 debug build which hits this assert: ASSERTION FAILED: !firstLineBox() == !lastLineBox() (/Users/matt/Code/WebKit/WebCore/rendering/RenderInline.cpp:327 virtual int WebCore::RenderInline::height() const) I can't get this to crash in a release build though (using r25145 nightly). Thread 0 Crashed: 0 com.apple.WebCore 0x0119d01c WebCore::RenderInline::height() const + 144 (RenderInline.cpp:327) 1 com.apple.WebCore 0x01195a80 WebCore::RenderFlow::absoluteClippedOverflowRect() + 1164 (RenderFlow.cpp:503) 2 com.apple.WebCore 0x011b5c00 WebCore::RenderObject::repaint(bool) + 228 (RenderObject.cpp:1753) 3 com.apple.WebCore 0x0117a1b8 WebCore::RenderBox::imageChanged(WebCore::CachedImage*) + 292 (RenderBox.cpp:464) 4 com.apple.WebCore 0x0112cc04 WebCore::CachedImage::ref(WebCore::CachedResourceClient*) + 152 (CachedImage.cpp:83) 5 com.apple.WebCore 0x011994cc WebCore::RenderImage::setCachedImage(WebCore::CachedImage*) + 184 (RenderImage.cpp:71) 6 com.apple.WebCore 0x01337390 WebCore::HTMLImageLoader::notifyFinished(WebCore::CachedResource*) + 144 (HTMLImageLoader.cpp:142) 7 com.apple.WebCore 0x0112cfc0 WebCore::CachedImage::checkNotify() + 108 (CachedImage.cpp:218) 8 com.apple.WebCore 0x0112d2ec WebCore::CachedImage::data(WTF::PassRefPtr<WebCore::SharedBuffer>, bool) + 428 (CachedImage.cpp:201) 9 com.apple.WebCore 0x01131f68 WebCore::Loader::didFinishLoading(WebCore::SubresourceLoader*) + 408 (loader.cpp:116) 10 com.apple.WebCore 0x01493034 WebCore::SubresourceLoader::didFinishLoading() + 204 (SubresourceLoader.cpp:195) 11 com.apple.WebCore 0x01490e38 WebCore::ResourceLoader::didFinishLoading(WebCore::ResourceHandle*) + 60 12 com.apple.WebCore 0x01464a68 -[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:] + 204 (ResourceHandleMac.mm:443) 13 com.apple.Foundation 0x92c1389c -[NSURLConnection(NSURLConnectionInternal) _sendDidFinishLoadingCallback] + 188 14 com.apple.Foundation 0x92c11b08 -[NSURLConnection(NSURLConnectionInternal) _sendCallbacks] + 556 1984 4 ddkilzer 2007-08-19 09:37:02 -0700 With a local debug build of WebKit r25142 with Safari 3 Public Beta v. 3.0.3 (522.12.1) on Mac OS X 10.4.10 (8R218), I get an assertion failure: ASSERTION FAILED: !firstLineBox() == !lastLineBox() (/path/to/WebKit/WebCore/rendering/RenderInline.cpp:327 virtual int WebCore::RenderInline::height() const) Segmentation fault With WebKit Nightly r25145 and Safari 3 Public Beta v. 3.0.3 on 10.4.10, I don't see a crash. With the Safari 3 Public Beta v. 3.0.3 with its original WebKit on 10.4.10, I DO see the crash described in this bug. With Safari 2.0.4 (419.3) with its original WebKit on 10.4.10, I do not see the crash. 1983 5 mitz 2007-08-19 09:53:09 -0700 P1 since this does lead to a crash. I am preparing a patch now. 1982 6 16023 mitz 2007-08-19 10:34:47 -0700 Created attachment 16023 Check that the renderer is an image before calling RenderImage methods Follows the existing behavior of loading the image even if it is not to be rendered. 1978 7 16023 aroben 2007-08-19 10:44:17 -0700 Comment on attachment 16023 Check that the renderer is an image before calling RenderImage methods + if (RenderObject* renderer = element()->renderer()) { + if (renderer->isImage()) + static_cast<RenderImage*>(renderer)->resetAnimation(); + } The braces here aren't necessary (or anywhere else in the lines you added in this patch). r=me 1972 8 dev+webkit 2007-08-19 11:34:06 -0700 Committed revision 25150 with the brace tweaks Adam mentioned. 16023 2007-08-19 10:34:47 -0700 2007-08-19 10:44:17 -0700 Check that the renderer is an image before calling RenderImage methods 15008_r1.patch text/plain 4361 mitz SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiAyNTE0OSkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTggQEAKKzIwMDctMDgtMTkgIE1pdHogUGV0dGVsICA8bWl0ekB3ZWJraXQub3Jn PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIC0gZml4 IGh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE1MDA4CisgICAgICAgICAg QVNTRVJUSU9OIEZBSUxFRDogIWZpcnN0TGluZUJveCgpID09ICFsYXN0TGluZUJveCgpIHNldHRp bmcgY29udGVudCBvbiBpbWFnZQorCisgICAgICAgIFRlc3Q6IGZhc3QvaW1hZ2VzL3RleHQtY29u dGVudC1jcmFzaC0yLmh0bWwKKworICAgICAgICAqIGh0bWwvSFRNTEltYWdlTG9hZGVyLmNwcDoK KyAgICAgICAgKFdlYkNvcmU6OkhUTUxJbWFnZUxvYWRlcjo6c2V0SW1hZ2UpOiBBZGRlZCBhIGNo ZWNrIHRoYXQgdGhlIHJlbmRlcmVyIGlzIGFuCisgICAgICAgIGltYWdlLgorICAgICAgICAoV2Vi Q29yZTo6SFRNTEltYWdlTG9hZGVyOjp1cGRhdGVGcm9tRWxlbWVudCk6IERpdHRvLgorICAgICAg ICAoV2ViQ29yZTo6SFRNTEltYWdlTG9hZGVyOjpub3RpZnlGaW5pc2hlZCk6IERpdHRvLgorCiAy MDA3LTA4LTE3ICBNYWNpZWogU3RhY2hvd2lhayAgPG1qc0BhcHBsZS5jb20+CiAKICAgICAgICAg UmV2aWV3ZWQgYnkgRGFyaW4uCkluZGV4OiBXZWJDb3JlL2h0bWwvSFRNTEltYWdlTG9hZGVyLmNw cAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09Ci0tLSBXZWJDb3JlL2h0bWwvSFRNTEltYWdlTG9hZGVyLmNwcAkocmV2aXNp b24gMjUxNDcpCisrKyBXZWJDb3JlL2h0bWwvSFRNTEltYWdlTG9hZGVyLmNwcAkod29ya2luZyBj b3B5KQpAQCAtNjcsOCArNjcsMTAgQEAgdm9pZCBIVE1MSW1hZ2VMb2FkZXI6OnNldEltYWdlKENh Y2hlZEltYQogICAgICAgICAgICAgb2xkSW1hZ2UtPmRlcmVmKHRoaXMpOwogICAgIH0KIAotICAg IGlmIChSZW5kZXJJbWFnZSogcmVuZGVyZXIgPSBzdGF0aWNfY2FzdDxSZW5kZXJJbWFnZSo+KGVs ZW1lbnQoKS0+cmVuZGVyZXIoKSkpCi0gICAgICAgIHJlbmRlcmVyLT5yZXNldEFuaW1hdGlvbigp OworICAgIGlmIChSZW5kZXJPYmplY3QqIHJlbmRlcmVyID0gZWxlbWVudCgpLT5yZW5kZXJlcigp KSB7CisgICAgICAgIGlmIChyZW5kZXJlci0+aXNJbWFnZSgpKQorICAgICAgICAgICAgc3RhdGlj X2Nhc3Q8UmVuZGVySW1hZ2UqPihyZW5kZXJlciktPnJlc2V0QW5pbWF0aW9uKCk7CisgICAgfQog fQogCiB2b2lkIEhUTUxJbWFnZUxvYWRlcjo6c2V0TG9hZGluZ0ltYWdlKENhY2hlZEltYWdlICps b2FkaW5nSW1hZ2UpCkBAIC0xMTUsOCArMTE3LDEwIEBAIHZvaWQgSFRNTEltYWdlTG9hZGVyOjp1 cGRhdGVGcm9tRWxlbWVudCgKICAgICAgICAgICAgIG9sZEltYWdlLT5kZXJlZih0aGlzKTsKICAg ICB9CiAKLSAgICBpZiAoUmVuZGVySW1hZ2UqIHJlbmRlcmVyID0gc3RhdGljX2Nhc3Q8UmVuZGVy SW1hZ2UqPihlbGVtLT5yZW5kZXJlcigpKSkKLSAgICAgICAgcmVuZGVyZXItPnJlc2V0QW5pbWF0 aW9uKCk7CisgICAgaWYgKFJlbmRlck9iamVjdCogcmVuZGVyZXIgPSBlbGVtLT5yZW5kZXJlcigp KSB7CisgICAgICAgIGlmIChyZW5kZXJlci0+aXNJbWFnZSgpKQorICAgICAgICAgICAgc3RhdGlj X2Nhc3Q8UmVuZGVySW1hZ2UqPihyZW5kZXJlciktPnJlc2V0QW5pbWF0aW9uKCk7CisgICAgfQog fQogCiB2b2lkIEhUTUxJbWFnZUxvYWRlcjo6ZGlzcGF0Y2hMb2FkRXZlbnQoKQpAQCAtMTM3LDgg KzE0MSwxMCBAQCB2b2lkIEhUTUxJbWFnZUxvYWRlcjo6bm90aWZ5RmluaXNoZWQoQ2FjCiAgICAg ICAgIGlmICghZG9jLT5vd25lckVsZW1lbnQoKSkKICAgICAgICAgICAgIHByaW50ZigiSW1hZ2Ug bG9hZGVkIGF0ICVkXG4iLCBkb2MtPmVsYXBzZWRUaW1lKCkpOwogI2VuZGlmCi0gICAgaWYgKFJl bmRlckltYWdlKiByZW5kZXJlciA9IHN0YXRpY19jYXN0PFJlbmRlckltYWdlKj4oZWxlbS0+cmVu ZGVyZXIoKSkpCi0gICAgICAgIHJlbmRlcmVyLT5zZXRDYWNoZWRJbWFnZShtX2ltYWdlKTsKKyAg ICBpZiAoUmVuZGVyT2JqZWN0KiByZW5kZXJlciA9IGVsZW0tPnJlbmRlcmVyKCkpIHsKKyAgICAg ICAgaWYgKHJlbmRlcmVyLT5pc0ltYWdlKCkpCisgICAgICAgICAgICBzdGF0aWNfY2FzdDxSZW5k ZXJJbWFnZSo+KHJlbmRlcmVyKS0+c2V0Q2FjaGVkSW1hZ2UobV9pbWFnZSk7CisgICAgfQogfQog CiB9CkluZGV4OiBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVz dHMvQ2hhbmdlTG9nCShyZXZpc2lvbiAyNTE0OSkKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwko d29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBACisyMDA3LTA4LTE5ICBNaXR6IFBldHRlbCAg PG1pdHpAd2Via2l0Lm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4K KworICAgICAgICAtIHRlc3QgZm9yIGh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp P2lkPTE1MDA4CisgICAgICAgICAgQVNTRVJUSU9OIEZBSUxFRDogIWZpcnN0TGluZUJveCgpID09 ICFsYXN0TGluZUJveCgpIHNldHRpbmcgY29udGVudCBvbiBpbWFnZQorCisgICAgICAgICogZmFz dC9pbWFnZXMvdGV4dC1jb250ZW50LWNyYXNoLTItZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAg ICAgKiBmYXN0L2ltYWdlcy90ZXh0LWNvbnRlbnQtY3Jhc2gtMi5odG1sOiBBZGRlZC4KKwogMjAw Ny0wOC0xOSAgRGF2aWQgS2lsemVyICA8ZGRraWx6ZXJAd2Via2l0Lm9yZz4KIAogICAgICAgICBS ZXZpZXdlZCBieSBBZGFtIGFuZCBHZW9mZiB3aXRoaW4gb25lIG1pbnV0ZSBvZiBlYWNoIG90aGVy LgpJbmRleDogTGF5b3V0VGVzdHMvZmFzdC9pbWFnZXMvdGV4dC1jb250ZW50LWNyYXNoLTItZXhw ZWN0ZWQudHh0Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2Zhc3QvaW1hZ2VzL3RleHQtY29u dGVudC1jcmFzaC0yLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Zh c3QvaW1hZ2VzL3RleHQtY29udGVudC1jcmFzaC0yLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkK QEAgLTAsMCArMSw1IEBACitUZXN0IGZvciBodHRwOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD0xNTAwOCBBU1NFUlRJT04gRkFJTEVEOiAhZmlyc3RMaW5lQm94KCkgPT0gIWxhc3RM aW5lQm94KCkgc2V0dGluZyBjb250ZW50IG9uIGltYWdlLgorCitObyBjcmFzaCBtZWFucyBTVUND RVNTLgorCisKSW5kZXg6IExheW91dFRlc3RzL2Zhc3QvaW1hZ2VzL3RleHQtY29udGVudC1jcmFz aC0yLmh0bWwKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9pbWFnZXMvdGV4dC1jb250 ZW50LWNyYXNoLTIuaHRtbAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Zhc3QvaW1hZ2Vz L3RleHQtY29udGVudC1jcmFzaC0yLmh0bWwJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMTkgQEAK KzxodG1sPgorPGhlYWQ+CisgICAgPHRpdGxlPjwvdGl0bGU+CisgICAgPHNjcmlwdD4KKyAgICAg ICAgaWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikKKyAgICAgICAgICAgIGxheW91dFRl c3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKKyAgICA8L3NjcmlwdD4KKzwvaGVhZD4KKzxib2R5 PgorICAgIDxwPgorICAgICAgICBUZXN0IGZvciA8aT48YSBocmVmPSJodHRwOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTAwOCI+aHR0cDovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9MTUwMDg8L2E+CisgICAgICAgIEFTU0VSVElPTiBGQUlMRUQ6ICFmaXJzdExp bmVCb3goKSA9PSAhbGFzdExpbmVCb3goKSBzZXR0aW5nIGNvbnRlbnQgb24gaW1hZ2U8L2k+Lgor ICAgIDwvcD4KKyAgICA8cD4KKyAgICAgICAgTm8gY3Jhc2ggbWVhbnMgU1VDQ0VTUy4KKyAgICA8 L3A+CisgICAgPGltZyBzdHlsZT0iY29udGVudDogJ2Zvbyc7IiBzcmM9InJlc291cmNlcy9hbmlt YXRlZC5naWYiPgorPC9ib2R5PgorPC9odG1sPgo=