17988 2008-03-21 12:50:44 -0700 REGRESSION (r31114-31132): Crash in InlineBox::isDirty() opening chowhound.com 2008-03-24 21:40:08 -0700 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) Mac OS X 10.5 RESOLVED FIXED http://www.chowhound.com InRadar, Regression P1 Normal --- 1 jomiku webkit-unassigned mitz oldest_to_newest 74678 0 jomiku 2008-03-21 12:50:44 -0700 chowhound.com crashes on opening only in webkit, not in shipping Safari. Using build r31201. Report shows: Exception Type: EXC_BAD_ACCESS (SIGBUS) Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000040 Crashed Thread: 0 Thread 0 Crashed: 0 com.apple.WebCore 0x00fbb9c3 WebCore::RenderBlock::layoutInlineChildren(bool, int&, int&) +1827 74679 1 mrowe 2008-03-21 12:54:59 -0700 Can you please attach the complete crash log? 74680 2 dev+webkit 2008-03-21 13:01:48 -0700 Confirmed with r31213: Thread 0 Crashed: 0 com.apple.WebCore 0x01d242fb WebCore::InlineBox::isDirty() const + 9 (InlineBox.h:217) 1 com.apple.WebCore 0x0209f3a8 WebCore::RootInlineBox::floats() + 24 (RootInlineBox.h:124) 2 com.apple.WebCore 0x0209d638 WebCore::RenderBlock::layoutInlineChildren(bool, int&, int&) + 4060 (bidi.cpp:950) 3 com.apple.WebCore 0x01e97839 WebCore::RenderBlock::layoutBlock(bool) + 1305 (RenderBlock.cpp:580) 4 com.apple.WebCore 0x01e869ee WebCore::RenderBlock::layout() + 54 (RenderBlock.cpp:494) 5 com.apple.WebCore 0x01ed199e WebCore::RenderListItem::layout() + 106 (RenderListItem.cpp:234) 6 com.apple.WebCore 0x0209e24d WebCore::RenderObject::layoutIfNeeded() + 41 (RenderObject.h:496) 7 com.apple.WebCore 0x0209cabd WebCore::RenderBlock::layoutInlineChildren(bool, int&, int&) + 1121 (bidi.cpp:806) 8 com.apple.WebCore 0x01e97839 WebCore::RenderBlock::layoutBlock(bool) + 1305 (RenderBlock.cpp:580) 9 com.apple.WebCore 0x01e869ee WebCore::RenderBlock::layout() + 54 (RenderBlock.cpp:494) 10 com.apple.WebCore 0x01e96135 WebCore::RenderBlock::layoutBlockChildren(bool, int&) + 1515 (RenderBlock.cpp:1233) 11 com.apple.WebCore 0x01e9785b WebCore::RenderBlock::layoutBlock(bool) + 1339 (RenderBlock.cpp:585) 12 com.apple.WebCore 0x01e869ee WebCore::RenderBlock::layout() + 54 (RenderBlock.cpp:494) 13 com.apple.WebCore 0x01e96135 WebCore::RenderBlock::layoutBlockChildren(bool, int&) + 1515 (RenderBlock.cpp:1233) 14 com.apple.WebCore 0x01e9785b WebCore::RenderBlock::layoutBlock(bool) + 1339 (RenderBlock.cpp:585) 15 com.apple.WebCore 0x01e869ee WebCore::RenderBlock::layout() + 54 (RenderBlock.cpp:494) 16 com.apple.WebCore 0x01e96135 WebCore::RenderBlock::layoutBlockChildren(bool, int&) + 1515 (RenderBlock.cpp:1233) 17 com.apple.WebCore 0x01e9785b WebCore::RenderBlock::layoutBlock(bool) + 1339 (RenderBlock.cpp:585) 18 com.apple.WebCore 0x01e869ee WebCore::RenderBlock::layout() + 54 (RenderBlock.cpp:494) 19 com.apple.WebCore 0x01e96135 WebCore::RenderBlock::layoutBlockChildren(bool, int&) + 1515 (RenderBlock.cpp:1233) 20 com.apple.WebCore 0x01e9785b WebCore::RenderBlock::layoutBlock(bool) + 1339 (RenderBlock.cpp:585) 21 com.apple.WebCore 0x01e869ee WebCore::RenderBlock::layout() + 54 (RenderBlock.cpp:494) 22 com.apple.WebCore 0x01e96135 WebCore::RenderBlock::layoutBlockChildren(bool, int&) + 1515 (RenderBlock.cpp:1233) 23 com.apple.WebCore 0x01e9785b WebCore::RenderBlock::layoutBlock(bool) + 1339 (RenderBlock.cpp:585) 24 com.apple.WebCore 0x01e869ee WebCore::RenderBlock::layout() + 54 (RenderBlock.cpp:494) 25 com.apple.WebCore 0x01e96135 WebCore::RenderBlock::layoutBlockChildren(bool, int&) + 1515 (RenderBlock.cpp:1233) 26 com.apple.WebCore 0x01e9785b WebCore::RenderBlock::layoutBlock(bool) + 1339 (RenderBlock.cpp:585) 27 com.apple.WebCore 0x01e869ee WebCore::RenderBlock::layout() + 54 (RenderBlock.cpp:494) 28 com.apple.WebCore 0x01f36da0 WebCore::RenderView::layout() + 298 (RenderView.cpp:116) 29 com.apple.WebCore 0x01c841f0 WebCore::FrameView::layout(bool) + 2194 (FrameView.cpp:479) 30 com.apple.WebCore 0x01c846ed WebCore::FrameView::layoutTimerFired(WebCore::Timer<WebCore::FrameView>*) + 25 (FrameView.cpp:723) 31 com.apple.WebCore 0x01c86733 WebCore::Timer<WebCore::FrameView>::fired() + 89 (Timer.h:99) 32 com.apple.WebCore 0x0205c47c WebCore::TimerBase::fireTimers(double, WTF::Vector<WebCore::TimerBase*, 0ul> const&) + 198 (Timer.cpp:350) 33 com.apple.WebCore 0x0205c524 WebCore::TimerBase::sharedTimerFired() + 110 (Timer.cpp:370) 34 com.apple.WebCore 0x0203711c WebCore::timerFired(__CFRunLoopTimer*, void*) + 78 (SharedTimerMac.mm:85) 35 com.apple.CoreFoundation 0x96cf9b5e CFRunLoopRunSpecific + 4494 36 com.apple.CoreFoundation 0x96cf9d18 CFRunLoopRunInMode + 88 37 com.apple.HIToolbox 0x903b66a0 RunCurrentEventLoopInMode + 283 38 com.apple.HIToolbox 0x903b64b9 ReceiveNextEventCommon + 374 39 com.apple.HIToolbox 0x903b632d BlockUntilNextEventMatchingListInMode + 106 40 com.apple.AppKit 0x9329f7d9 _DPSNextEvent + 657 41 com.apple.AppKit 0x9329f08e -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128 42 com.apple.Safari 0x0000806e 0x1000 + 28782 43 com.apple.AppKit 0x932980c5 -[NSApplication run] + 795 44 com.apple.AppKit 0x9326530a NSApplicationMain + 574 45 com.apple.Safari 0x000b9a76 0x1000 + 756342 74730 3 19949 mitz 2008-03-21 20:28:31 -0700 Created attachment 19949 Reduction (will crash) 74733 4 19951 mitz 2008-03-21 20:53:07 -0700 Created attachment 19951 Add null check to cover the case of "childrenInline" blocks that have no in-flow content 74765 5 mitz 2008-03-21 23:58:53 -0700 Fixed in <http://trac.webkit.org/projects/webkit/changeset/31227>. 75062 6 mitz 2008-03-24 21:40:08 -0700 <rdar://problem/5810802> 19949 2008-03-21 20:28:31 -0700 2008-03-21 20:28:31 -0700 Reduction (will crash) 17988 reduction.html text/html 101 mitz PHN0eWxlPgogICAgc3Bhbjo6YWZ0ZXIge2NvbnRlbnQ6ICcnOyB9Cjwvc3R5bGU+CjxzcGFuPgog ICAgPGRpdiBzdHlsZT0iZmxvYXQ6IGxlZnQ7Ij48L2Rpdj4KPC9zcGFuPgo= 19951 2008-03-21 20:53:07 -0700 2008-03-21 23:53:33 -0700 Add null check to cover the case of "childrenInline" blocks that have no in-flow content 17988_r1.diff text/plain 3497 mitz SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiAzMTIyNSkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTggQEAKKzIwMDgtMDMtMjEgIERhbiBCZXJuc3RlaW4gIDxtaXR6QGFwcGxlLmNv bT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAtIGZp eCBodHRwOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNzk4OAorICAgICAgICAg IFJFR1JFU1NJT04gKHIzMTExNC0zMTEzMik6IENyYXNoIGluIElubGluZUJveDo6aXNEaXJ0eSgp IG9wZW5pbmcgY2hvd2hvdW5kLmNvbQorCisgICAgICAgIFRlc3Q6IGZhc3QvY3NzLWdlbmVyYXRl ZC1jb250ZW50L2VtcHR5LWNvbnRlbnQtd2l0aC1mbG9hdC1jcmFzaC5odG1sCisKKyAgICAgICAg KiByZW5kZXJpbmcvYmlkaS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpSZW5kZXJCbG9jazo6bGF5 b3V0SW5saW5lQ2hpbGRyZW4pOiBBZGRlZCBhIG51bGwgY2hlY2sgZm9yCisgICAgICAgIHRoZSBj YXNlIHdoZXJlIHRoZSBibG9jayBjb250YWlucyBubyBpbi1mbG93IGVsZW1lbnRzIGJ1dCBzdGls bCBsYXlzCisgICAgICAgIG91dCBhcyBhIGxpbmUgZmxvdywgd2hpY2ggY2FuIGhhcHBlbiBhcyBh IHJlc3VsdCBvZiBlbXB0eSBnZW5lcmF0ZWQKKyAgICAgICAgY29udGVudC4KKwogMjAwOC0wMy0y MSAgU2FtIFdlaW5pZyAgPHNhbUB3ZWJraXQub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IE9s aXZlciBIdW50LgpJbmRleDogV2ViQ29yZS9yZW5kZXJpbmcvYmlkaS5jcHAKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gV2ViQ29yZS9yZW5kZXJpbmcvYmlkaS5jcHAJKHJldmlzaW9uIDMxMjI1KQorKysgV2ViQ29y ZS9yZW5kZXJpbmcvYmlkaS5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTkzOSw3ICs5MzksNyBAQCB2 b2lkIFJlbmRlckJsb2NrOjpsYXlvdXRJbmxpbmVDaGlsZHJlbihiCiAgICAgICAgICAgICAgICAg bmV3TGluZShjbGVhcik7CiAgICAgICAgICAgICB9CiAKLSAgICAgICAgICAgIGlmIChtX2Zsb2F0 aW5nT2JqZWN0cykgeworICAgICAgICAgICAgaWYgKG1fZmxvYXRpbmdPYmplY3RzICYmIGxhc3RS b290Qm94KCkpIHsKICAgICAgICAgICAgICAgICBpZiAobGFzdEZsb2F0KSB7CiAgICAgICAgICAg ICAgICAgICAgIGZvciAoRmxvYXRpbmdPYmplY3QqIGYgPSBtX2Zsb2F0aW5nT2JqZWN0cy0+bGFz dCgpOyBmICE9IGxhc3RGbG9hdDsgZiA9IG1fZmxvYXRpbmdPYmplY3RzLT5wcmV2KCkpIHsKICAg ICAgICAgICAgICAgICAgICAgfQpJbmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT0KLS0tIExheW91dFRlc3RzL0NoYW5nZUxvZwkocmV2aXNpb24gMzEyMjUpCisrKyBMYXlvdXRU ZXN0cy9DaGFuZ2VMb2cJKHdvcmtpbmcgY29weSkKQEAgLTEsMyArMSwxMyBAQAorMjAwOC0wMy0y MSAgRGFuIEJlcm5zdGVpbiAgPG1pdHpAYXBwbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIC0gdGVzdCBmb3IgaHR0cDovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTc5ODgKKyAgICAgICAgICBSRUdSRVNTSU9OIChyMzExMTQt MzExMzIpOiBDcmFzaCBpbiBJbmxpbmVCb3g6OmlzRGlydHkoKSBvcGVuaW5nIGNob3dob3VuZC5j b20KKworICAgICAgICAqIGZhc3QvY3NzLWdlbmVyYXRlZC1jb250ZW50L2VtcHR5LWNvbnRlbnQt d2l0aC1mbG9hdC1jcmFzaC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZhc3QvY3Nz LWdlbmVyYXRlZC1jb250ZW50L2VtcHR5LWNvbnRlbnQtd2l0aC1mbG9hdC1jcmFzaC5odG1sOiBB ZGRlZC4KKwogMjAwOC0wMy0yMSAgT2xpdmVyIEh1bnQgIDxvbGl2ZXJAYXBwbGUuY29tPgogCiAg ICAgICAgIFJldmlld2VkIGJ5IEdlb2ZmIEdhcmVuLgpJbmRleDogTGF5b3V0VGVzdHMvZmFzdC9j c3MtZ2VuZXJhdGVkLWNvbnRlbnQvZW1wdHktY29udGVudC13aXRoLWZsb2F0LWNyYXNoLWV4cGVj dGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L2Nzcy1nZW5lcmF0ZWQtY29u dGVudC9lbXB0eS1jb250ZW50LXdpdGgtZmxvYXQtY3Jhc2gtZXhwZWN0ZWQudHh0CShyZXZpc2lv biAwKQorKysgTGF5b3V0VGVzdHMvZmFzdC9jc3MtZ2VuZXJhdGVkLWNvbnRlbnQvZW1wdHktY29u dGVudC13aXRoLWZsb2F0LWNyYXNoLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKQEAgLTAsMCAr MSw1IEBACitUZXN0IGZvciBodHRwOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0x Nzk4OCBSRUdSRVNTSU9OIChyMzExMTQtMzExMzIpOiBDcmFzaCBpbiBJbmxpbmVCb3g6OmlzRGly dHkoKSBvcGVuaW5nIGNob3dob3VuZC5jb20uCisKK05vIGNyYXNoIG1lYW5zIFBBU1MuCisKKwpJ bmRleDogTGF5b3V0VGVzdHMvZmFzdC9jc3MtZ2VuZXJhdGVkLWNvbnRlbnQvZW1wdHktY29udGVu dC13aXRoLWZsb2F0LWNyYXNoLmh0bWwKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9j c3MtZ2VuZXJhdGVkLWNvbnRlbnQvZW1wdHktY29udGVudC13aXRoLWZsb2F0LWNyYXNoLmh0bWwJ KHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L2Nzcy1nZW5lcmF0ZWQtY29udGVudC9l bXB0eS1jb250ZW50LXdpdGgtZmxvYXQtY3Jhc2guaHRtbAkocmV2aXNpb24gMCkKQEAgLTAsMCAr MSwxNyBAQAorPHNjcmlwdD4KKyAgICBpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKQor ICAgICAgICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7Cis8L3NjcmlwdD4KKzxz dHlsZT4KKyAgICBzcGFuOjphZnRlciB7Y29udGVudDogJyc7IH0KKzwvc3R5bGU+Cis8cD4KKyAg ICBUZXN0IGZvciA8aT48YSBocmVmPSJodHRwOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNn aT9pZD0xNzk4OCI+aHR0cDovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTc5ODg8 L2E+CisgICAgUkVHUkVTU0lPTiAocjMxMTE0LTMxMTMyKTogQ3Jhc2ggaW4gSW5saW5lQm94Ojpp c0RpcnR5KCkgb3BlbmluZyBjaG93aG91bmQuY29tPC9pPi4KKzwvcD4KKzxwPgorICAgIE5vIGNy YXNoIG1lYW5zIFBBU1MuCis8L3A+Cis8c3Bhbj4KKyAgICA8ZGl2IHN0eWxlPSJmbG9hdDogbGVm dDsiPjwvZGl2PgorPC9zcGFuPgo=