184748 2018-04-18 12:55:19 -0700 SVG Text rendering causes infinite loop (spinning wait cursor) 2022-11-26 02:33:42 -0800 1 1 1 Unclassified WebKit SVG Safari 11 All macOS 10.13 NEW https://bugs.webkit.org/show_bug.cgi?id=248357 InRadar P2 Normal --- 1 samuel.hazlehurst webkit-unassigned mmaxfield sabouhallawa webkit-bug-importer zimmermann oldest_to_newest 1415656 0 338247 samuel.hazlehurst 2018-04-18 12:55:19 -0700 Created attachment 338247 File that demonstrates bug Load attached svgError.html in Safari Version 11.1 (13605.1.33.1.2), enter a line in textarea (max 20 characters), press return, after typing first or second character, Safari will display wait cursor, CPU usage spikes, etc. /usr/bin/sample shows webkit stuck in WebCore::SVGTextLayoutEngine::currentLogicalCharacterMetrics (which suspiciously starts with the code 'while (true) {' :) Bug doesn't manifest 100% of the time, exhibits in both macOS & iOS safari, no other browsers I've tried. /usr/bin/sample output: Sampling process 9893 for 3 seconds with 1 millisecond of run time between samples Sampling completed, processing symbols... Analysis of sampling com.apple.WebKit.WebContent (pid 9893) every 1 millisecond Process: com.apple.WebKit.WebContent [9893] Path: /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent Load Address: 0x10f3fa000 Identifier: com.apple.WebKit.WebContent Version: 13605 (13605.1.33.1.2) Build Info: WebKit2-7605001033001002~5 Code Type: X86-64 Parent Process: ??? [1] Date/Time: 2018-04-18 15:28:10.240 -0400 Launch Time: 2018-04-18 15:24:58.835 -0400 OS Version: Mac OS X 10.13.4 (17E199) Report Version: 7 Analysis Tool: /usr/bin/sample Physical footprint: 25.1M Physical footprint (peak): 61.1M ---- Call graph: 2696 Thread_1465610 DispatchQueue_1: com.apple.main-thread (serial) + 2696 start (in libdyld.dylib) + 1 [0x7fff7b43f015] + 2696 ??? (in com.apple.WebKit.WebContent) load address 0x10f3fa000 + 0x16a1 [0x10f3fb6a1] + 2696 xpc_main (in libxpc.dylib) + 417 [0x7fff7b798baa] + 2696 _xpc_objc_main (in libxpc.dylib) + 580 [0x7fff7b799f57] + 2696 NSApplicationMain (in AppKit) + 804 [0x7fff50684a72] + 2696 -[NSApplication run] (in AppKit) + 764 [0x7fff506b5885] + 2696 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (in AppKit) + 3044 [0x7fff50e56e34] + 2696 _DPSNextEvent (in AppKit) + 2085 [0x7fff506c0a73] + 2696 _BlockUntilNextEventMatchingListInModeWithFilter (in HIToolbox) + 64 [0x7fff5240d884] + 2696 ReceiveNextEventCommon (in HIToolbox) + 613 [0x7fff5240db06] + 2696 RunCurrentEventLoopInMode (in HIToolbox) + 286 [0x7fff5240dd96] + 2696 CFRunLoopRunSpecific (in CoreFoundation) + 483 [0x7fff531251a3] + 2696 __CFRunLoopRun (in CoreFoundation) + 2427 [0x7fff53125dab] + 2696 __CFRunLoopDoTimers (in CoreFoundation) + 346 [0x7fff5312e7da] + 2696 __CFRunLoopDoTimer (in CoreFoundation) + 1095 [0x7fff5312ecd7] + 2696 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ (in CoreFoundation) + 20 [0x7fff5312f064] + 2696 WebCore::timerFired(__CFRunLoopTimer*, void*) (in WebCore) + 31 [0x7fff6040846f] + 2696 WebCore::ThreadTimers::sharedTimerFiredInternal() (in WebCore) + 176 [0x7fff60408530] + 2696 WebCore::LayoutContext::layout() (in WebCore) + 1113 [0x7fff613ba2a9] + 2696 WebCore::RenderSVGRoot::layout() (in WebCore) + 325 [0x7fff60516905] + 2696 WebCore::SVGRenderSupport::layoutChildren(WebCore::RenderElement&, bool) (in WebCore) + 555 [0x7fff6175398b] + 2696 WebCore::RenderSVGText::layout() (in WebCore) + 691 [0x7fff605d5723] + 2696 WebCore::RenderBlockFlow::layoutLineBoxes(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) (in WebCore) + 1729 [0x7fff615f32e1] + 2696 WebCore::RenderBlockFlow::layoutRunsAndFloats(WebCore::LineLayoutState&, bool) (in WebCore) + 1253 [0x7fff615eee75] + 2696 WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange(WebCore::LineLayoutState&, WebCore::BidiResolverWithIsolate<WebCore::InlineIterator, WebCore::BidiRun, WebCore::BidiIsolatedRun>&, WebCore::InlineIterator const&, WebCore::BidiStatus const&, unsigned int) (in WebCore) + 5604 [0x7fff615f1434] + 2696 WebCore::RenderBlockFlow::createLineBoxesFromBidiRuns(unsigned int, WebCore::BidiRunList<WebCore::BidiRun>&, WebCore::InlineIterator const&, WebCore::LineInfo&, WebCore::VerticalPositionCache&, WebCore::BidiRun*, WTF::Vector<WebCore::WordMeasurement, 64ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&) (in WebCore) + 220 [0x7fff615ee8ac] + 2696 WebCore::SVGRootInlineBox::computePerCharacterLayoutInformation() (in WebCore) + 464 [0x7fff605d6a00] + 2696 WebCore::SVGRootInlineBox::layoutCharactersInTextBoxes(WebCore::InlineFlowBox*, WebCore::SVGTextLayoutEngine&) (in WebCore) + 493 [0x7fff605d6c7d] + 2696 WebCore::SVGRootInlineBox::layoutCharactersInTextBoxes(WebCore::InlineFlowBox*, WebCore::SVGTextLayoutEngine&) (in WebCore) + 183 [0x7fff605d6b47] + 2696 WebCore::SVGRootInlineBox::layoutCharactersInTextBoxes(WebCore::InlineFlowBox*, WebCore::SVGTextLayoutEngine&) (in WebCore) + 104 [0x7fff605d6af8] + 2696 WebCore::SVGTextLayoutEngine::layoutInlineTextBox(WebCore::SVGInlineTextBox&) (in WebCore) + 122 [0x7fff6175cb4a] + 2696 WebCore::SVGTextLayoutEngine::layoutTextOnLineOrPath(WebCore::SVGInlineTextBox&, WebCore::RenderSVGInlineText&, WebCore::RenderStyle const&) (in WebCore) + 1054 [0x7fff6175eb3e] + 1835 WebCore::SVGTextLayoutEngine::currentLogicalCharacterMetrics(WebCore::SVGTextLayoutAttributes*&, WebCore::SVGTextMetrics&) (in WebCore) + 324 [0x7fff605d70c4] + ! 1835 WebCore::SVGTextLayoutEngine::currentLogicalCharacterAttributes(WebCore::SVGTextLayoutAttributes*&) (in WebCore) + 117,16,... [0x7fff605d6f75,0x7fff605d6f10,...] + 861 WebCore::SVGTextLayoutEngine::currentLogicalCharacterMetrics(WebCore::SVGTextLayoutAttributes*&, WebCore::SVGTextMetrics&) (in WebCore) + 324,33,... [0x7fff605d70c4,0x7fff605d6fa1,...] 1416650 1 webkit-bug-importer 2018-04-20 23:42:39 -0700 <rdar://problem/39618637> 1417370 2 sabouhallawa 2018-04-24 18:03:27 -0700 The hang happens because of a collapsing text run. A collapsing text run is a run which has logical attributes, i.e. text, but does not logical metrics, i.e. with and height. The real problem is SVGTextLayoutEngine::currentLogicalCharacterAttributes() and SVGTextLayoutEngine::currentLogicalCharacterMetrics() do not advance m_layoutAttributesPosition based on the same condition. -- SVGTextLayoutEngine::currentLogicalCharacterAttributes() advances m_layoutAttributesPosition only if (m_logicalCharacterOffset == logicalAttributes->context().text().length()) -- SVGTextLayoutEngine::currentLogicalCharacterMetrics() expects m_layoutAttributesPosition to be advanced if (m_logicalMetricsListOffset == textMetricsSize) And these conditions will not match if the layoutAttribute is for a collapsed run. 338247 2018-04-18 12:55:19 -0700 2018-04-18 12:55:19 -0700 File that demonstrates bug svgError.html text/html 4321 samuel.hazlehurst PGh0bWw+CiAgICA8aGVhZD4KCTxzY3JpcHQgc3JjPSJodHRwczovL2FqYXguZ29vZ2xlYXBpcy5j b20vYWpheC9saWJzL2pxdWVyeS8zLjMuMS9qcXVlcnkubWluLmpzIj48L3NjcmlwdD4KICAgIDwv aGVhZD4KICAgIDxib2R5PgoJPHRleHRhcmVhIGNsYXNzPSJnaXZlLXRleHRhcmVhIHJlcXVpcmVk IiBuYW1lPSJnaXZlX2VuZ3JhdmluZ19tZXNzYWdlIiBpZD0iZ2l2ZS1lbmdyYXZpbmctbWVzc2Fn ZSIgYXJpYS1yZXF1aXJlZD0idHJ1ZSIgcmVxdWlyZWQ9IiIgcGxhY2Vob2xkZXI9IlBsZWFzZSB0 eXBlIHlvdXIgbWVzc2FnZSBoZXJlLiBTaXggbGluZXMsIHdpdGggYSBtYXhpbXVtIG9mIDIwIGNo YXJhY3RlcnMgcGVyIGxpbmUuIiBzdHlsZT0iaGVpZ2h0OiAyMzBweDtkaXNwbGF5OiBibG9jazsi PjwvdGV4dGFyZWE+CgkKCTxzdmcgdmlld0JveD0iMCAwIDE1MiAxNTIiIHZlcnNpb249IjEuMSIg eG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxuczp4bGluaz0iaHR0cDovL3d3 dy53My5vcmcvMTk5OS94bGluayIKCSAgICAgc3R5bGU9ImRpc3BsYXk6IGJsb2NrO21hcmdpbi1s ZWZ0OiBhdXRvO21hcmdpbi1yaWdodDogYXV0bzsiPgoJICAgIDxkZWZzPgoKCQk8c3R5bGUgdHlw ZT0idGV4dC9jc3MiPjwhW0NEQVRBWwoKCgkJICAgIC5tZWRpdW1fcGF2ZXJfc3R5bGVfMSB7CgkJ CWZpbGw6IHdoaXRlc21va2U7CgkJCXN0cm9rZTogIzVFNTU0QjsKCQkJc3Ryb2tlLXdpZHRoOiAx LjA7CgkJCXN0cm9rZS1saW5lY2FwOiBidXR0OwoJCQlzdHJva2UtbGluZWpvaW46IHJvdW5kOwoJ CSAgICB9CgoKCgkJIF1dPjwvc3R5bGU+CgoJCTxwYXRoIGlkPSJtZWRpdW1fcGF2ZXJfbGluZTEi IGQ9Ik0zMC42LDQyLjhjMzAuOCwtMy4zLDYyLC0zLjEsOTIuOCwwLjYiIC8+CgkJPHBhdGggaWQ9 Im1lZGl1bV9wYXZlcl9saW5lMiIgZD0iTTMyLjgsNTguMmMyOS41LC0zLDU5LjIsLTIuOSw4OC42 LDAuNSIgLz4KCQk8cGF0aCBpZD0ibWVkaXVtX3BhdmVyX2xpbmUzIiBkPSJNMzUsNzMuNkM2My4x LDcwLjgsOTEuMyw3MSwxMTkuMyw3NC4xIiAvPgoJCTxwYXRoIGlkPSJtZWRpdW1fcGF2ZXJfbGlu ZTQiIGQ9Ik0zNy4zLDg5YzI2LjYsLTIuNSw1My40LC0yLjMsODAsMC41IiAvPgoJCTxwYXRoIGlk PSJtZWRpdW1fcGF2ZXJfbGluZTUiIGQ9Ik0zOS41LDEwNC40YzI1LjIsLTIuMiw1MC42LC0yLDc1 LjgsMC41IiAvPgoJCTxwYXRoIGlkPSJtZWRpdW1fcGF2ZXJfbGluZTYiIGQ9Ik00MS44LDExOS44 YzIzLjcsLTEuOSw0Ny43LC0xLjgsNzEuNCwwLjUiIC8+CgoJICAgIDwvZGVmcz4KCgkgICAgPHBh dGggZmlsbC1ydWxlPSJldmVub2RkIiBkPSJNMjcuMywzMS41YzMzLjMsLTMuOSw2NywtMy43LDEw MC4yLDAuNmwtMTIsOTJDOTAuMiwxMjAuNyw2NC42LDEyMC41LDM5LjMsMTIzLjVsLTEyLC05Mloi IGNsYXNzPSJtZWRpdW1fcGF2ZXJfc3R5bGVfMSIgLz4KCgkgICAgPHRleHQgY2xhc3M9Im1lZGl1 bV9wYXZlcl90ZXh0X3N0eWxlIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBmaWxsPSJibGFjayIgc3Ry b2tlPSJub25lIiA+CgkJPHRleHRQYXRoIHhsaW5rOmhyZWY9IiNtZWRpdW1fcGF2ZXJfbGluZTEi IHN0YXJ0T2Zmc2V0PSI1MCUiPgoJCSAgICA8dHNwYW4gY2xhc3M9ImxpbmVfMV90ZXh0IG1lZGl1 bV9wYXZlcl90ZXh0X3N0eWxlIj48L3RzcGFuPgoJCTwvdGV4dFBhdGg+CgkJPHRleHRQYXRoIHhs aW5rOmhyZWY9IiNtZWRpdW1fcGF2ZXJfbGluZTIiIHN0YXJ0T2Zmc2V0PSI1MCUiPgoJCSAgICA8 dHNwYW4gY2xhc3M9ImxpbmVfMl90ZXh0Ij48L3RzcGFuPgoJCTwvdGV4dFBhdGg+CgkJPHRleHRQ YXRoIHhsaW5rOmhyZWY9IiNtZWRpdW1fcGF2ZXJfbGluZTMiIHN0YXJ0T2Zmc2V0PSI1MCUiPgoJ CSAgICA8dHNwYW4gY2xhc3M9ImxpbmVfM190ZXh0IiA+PC90c3Bhbj4KCQk8L3RleHRQYXRoPgoJ CTx0ZXh0UGF0aCB4bGluazpocmVmPSIjbWVkaXVtX3BhdmVyX2xpbmU0IiBzdGFydE9mZnNldD0i NTAlIj4KCQkgICAgPHRzcGFuIGNsYXNzPSJsaW5lXzRfdGV4dCIgPjwvdHNwYW4+CgkJPC90ZXh0 UGF0aD4KCQk8dGV4dFBhdGggeGxpbms6aHJlZj0iI21lZGl1bV9wYXZlcl9saW5lNSIgc3RhcnRP ZmZzZXQ9IjUwJSI+CgkJICAgIDx0c3BhbiBjbGFzcz0ibGluZV81X3RleHQiID48L3RzcGFuPgoJ CTwvdGV4dFBhdGg+CgkJPHRleHRQYXRoIHhsaW5rOmhyZWY9IiNtZWRpdW1fcGF2ZXJfbGluZTYi IHN0YXJ0T2Zmc2V0PSI1MCUiPgoJCSAgICA8dHNwYW4gY2xhc3M9ImxpbmVfNl90ZXh0IiA+PC90 c3Bhbj4KCQk8L3RleHRQYXRoPgoJICAgIDwvdGV4dD4KCTwvc3ZnPgoKCTxzY3JpcHQ+CgkgCgkg Ly8gV3JpdGUgdGhlIHRleHQgb250byB0aGUgc2FtcGxlIHBhdmVyICAgIAoJICQoJyNnaXZlLWVu Z3JhdmluZy1tZXNzYWdlJykua2V5dXAoIGZ1bmN0aW9uKGV2ZW50KSB7CgkgICAgIAoJICAgICBj b25zb2xlLmxvZygna2V5dXAnKTsKCSAgICAgdmFyIHRleHRfZm9yX3BhdmVyID0gdGhpcy52YWx1 ZS5zcGxpdCgnXG4nKS5zbGljZSgwLDYpLm1hcChmdW5jdGlvbih4KSB7IHJldHVybiB4LnN1YnN0 cmluZygwLDIwKTsgfSk7CgkgICAgIGNvbnNvbGUubG9nKCdnb3QgbGluZXMnKTsKCSAgICAgdmFy IGkgPSAwOwoJICAgICBmb3IgKDsgaSA8IHRleHRfZm9yX3BhdmVyLmxlbmd0aDsgaSsrKSB7CgkJ ICQoJy5saW5lXycgKyAoaSArIDEpICsgJ190ZXh0JykudGV4dCh0ZXh0X2Zvcl9wYXZlcltpXSk7 CgkgICAgIH0KCSAgICAgY29uc29sZS5sb2coJ3NldCBsaW5lcycpOwoJICAgICBmb3IgKDsgaSA8 IDY7IGkrKykgewoJCSAkKCcubGluZV8nICsgKGkgKyAxKSArICdfdGV4dCcpLnRleHQoJycpOwoJ ICAgICB9CgkgICAgIGNvbnNvbGUubG9nKCd1bnNldCByZW1haW5pbmcgbGluZXMnKTsKCSAgICAg cmV0dXJuIHRydWU7CgkgfSk7CgoJIAoKCSAkKCcjZ2l2ZS1lbmdyYXZpbmctbWVzc2FnZScpLmtl eWRvd24oIGZ1bmN0aW9uKGV2ZW50KSB7CgoJICAgICBjb25zb2xlLmxvZygna2V5cHJlc3MnKTsK CSAgICAgc3dpdGNoIChsb2NhdGlvbi5oYXNoLnJlcGxhY2UoJyMnLCcnKSkgewoKCQkgY2FzZSAn YmVuY2hfc2VsZWN0aW9uJzoKCQkgY2FzZSAndGFibGVfc2VsZWN0aW9uJzoKCQkgICAgIHJldHVy bjsKCQkgZGVmYXVsdDoKCQkgICAgIHZhciBudW1iZXJPZkxpbmVzID0gKHRoaXMudmFsdWUubWF0 Y2goL1xuL2cpIHx8IFtdKS5sZW5ndGggKyAxLAoJCQkgY3Vyc29yTG9jYXRpb24gPSAkKCcjZ2l2 ZS1lbmdyYXZpbmctbWVzc2FnZScpLnByb3AoJ3NlbGVjdGlvblN0YXJ0Jyk7ICAgIAoKCQkgICAg IGlmIChldmVudC53aGljaCA9PT0gMTMgJiYgbnVtYmVyT2ZMaW5lcyA9PT0gbWF4Um93cyApIHsg Ly8gMTMgaXMgQmFja3NwYWNlCgkJCSByZXR1cm4gZmFsc2U7CgkJICAgICB9CgoJCSAgICAgLy8g VGhpcyB3aWxsIHNwbGl0IHRoZSB0ZXh0IGludG8gYW4gYXJyYXkgb2YgbGluZXMsIGluY2x1ZGlu ZyB0aGUgbmV3bGluZSBiZXR3ZWVuIGxpbmVzIGluIHRoZSBhcnJheQoJCSAgICAgdmFyIHRleHQg PSB0aGlzLnZhbHVlLnNwbGl0KC8oXG4pL2cpOwoJCSAgICAgCgkJICAgICAvLyBOZWVkIHRvIGZp bmQgdGhlIGNhc2Ugd2hlcmUgdGhlIGN1cnNvciBpcyBhdCB0aGUgZW5kIG9mIGEgbGluZQoKCQkg ICAgIC8vIEZpcnN0LCBmaW5kIHRoZSBsaW5lIHRoZSBjdXJzb3IgaXMgb24KCgkJICAgICBpZiAo ZXZlbnQud2hpY2ggPiAzMSkgeyAvLyBrZXlwcmVzcyBpcyBhIGNoYXJhY3RlciAobW9yZSBvciBs ZXNzKSAgICAKCQkJIGZvciAodmFyIGkgPSAwOyBpIDwgdGV4dC5sZW5ndGg7IGkrKykgewoJCQkg ICAgIGlmIChjdXJzb3JMb2NhdGlvbiA8PSB0ZXh0W2ldLmxlbmd0aCkgeyAvLyBjdXJzb3IgaXMg b24gdGhpcyBsaW5lCgkJCQkgLy8gVGhpcyBtaWdodCBiZSBhbHRlcmVkIHRvIGJlIHNwZWNpZmlj IHRvIHRoZSBsaW5lIChmb3IgMzAgY2hhcmFjdGVyIGxpbmVzKQoJCQkJIC8vIEFsc28sIHdlJ3Jl IGFzc3VtaW5nIGEgbW9ub3NwYWNlZCBmb250IC0tIGlzIHRoaXMgY2FzZT8KCQkJCQkJCQkgICAg IGlmIChjdXJzb3JMb2NhdGlvbiA9PSAyMCkgewoJCQkJCQkJCQkgcmV0dXJuIGZhbHNlOwoJCQkJ CQkJCSAgICAgfQoJCQkgICAgIH0KCQkJICAgICBlbHNlIHsgLy8gc3VidHJhY3QgdGhlIGxpbmUg bGVuZ3RoCgkJCQkgY3Vyc29yTG9jYXRpb24gLT0gdGV4dFtpXS5sZW5ndGg7CgkJCSAgICAgfQoJ CQkgfQoJCSAgICAgfQoJICAgICB9CgkgICAgIC8vIE5lZWQgdG8gcmV0dXJuIGZhbHNlIGluIHRo ZSAKCSB9KTsKCgoKCgoKCTwvc2NyaXB0PgogICAgPC9ib2R5Pgo8L2h0bWw+Cg==