20396 2008-08-15 06:19:26 -0700 Abort caused by failed allocation due to invalid counter/attr 2008-09-30 16:20:20 -0700 1 1 1 Unclassified WebKit CSS 525.x (Safari 3.1) PC OS X 10.5 RESOLVED FIXED HasReduction, InRadar P2 Normal --- 1 taviso bdakin bdakin mrowe oldest_to_newest 88553 0 taviso 2008-08-15 06:19:26 -0700 <style type="text/css"> body { content: counter(-7036167556735246188); } </style> (content: attr(-4687060260085016321); also works) 88572 1 mrowe 2008-08-15 08:14:06 -0700 Safari(77064,0xa0314d00) malloc: *** mmap(size=2276515840) failed (error code=12) *** error: can't allocate region *** set a breakpoint in malloc_error_break to debug Program received signal SIGABRT, Aborted. 0x934e970a in __kill () (gdb) bt #0 0x934e970a in __kill () #1 0x934e96fd in kill$UNIX2003 () #2 0x9355d75f in raise () #3 0x9356f205 in abort () #4 0x00444080 in WTF::fastMalloc (n=2276512446) at FastMalloc.cpp:192 #5 0x0288a47f in WebCore::newUCharVector (n=3285739871) at WebCore/platform/text/StringImpl.cpp:52 #6 0x0288d3b2 in WebCore::StringImpl::StringImpl (this=0x1b2c0e70, characters=0x4745d548, length=3285739871) at WebCore/platform/text/StringImpl.cpp:79 #7 0x0288cb19 in WebCore::StringImpl::create (characters=0x4745d548, length=3285739871) at WebCore/platform/text/StringImpl.cpp:1019 #8 0x02887874 in WebCore::String::String (this=0xbfff9b5c, str=0x4745d548, len=3285739871) at WebCore/platform/text/String.cpp:50 #9 0x022b76ab in WebCore::CSSParserString::operator WebCore::String (this=0x45e32b4) at CSSParserValues.h:36 #10 0x022c8f9e in WebCore::CSSParser::parseCounterContent (this=0xbfffb2ec, args=0x45e32a0, counters=false) at WebCore/css/CSSParser.cpp:2658 #11 0x022ccd6e in WebCore::CSSParser::parseContent (this=0xbfffb2ec, propId=1036, important=false) at WebCore/css/CSSParser.cpp:1972 #12 0x022ce7fe in WebCore::CSSParser::parseValue (this=0xbfffb2ec, propId=1036, important=false) at WebCore/css/CSSParser.cpp:618 #13 0x022b63a0 in cssyyparse (parser=0xbfffb2ec) at CSSGrammar.y:1211 Confirmed with TOT WebKit. 88573 2 mrowe 2008-08-15 08:14:54 -0700 <rdar://problem/6152371> 93448 3 23958 bdakin 2008-09-30 16:07:06 -0700 Created attachment 23958 Patch 93451 4 23958 darin 2008-09-30 16:16:05 -0700 Comment on attachment 23958 Patch r=me 93456 5 bdakin 2008-09-30 16:20:20 -0700 Fixed with r37122. 23958 2008-09-30 16:07:06 -0700 2008-09-30 16:16:05 -0700 Patch counter.txt text/plain 2958 bdakin SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiAzNzEyMSkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTUgQEAKKzIwMDgtMDktMzAgIEJldGggRGFraW4gIDxiZGFraW5AYXBwbGUuY29t PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEZpeCBm b3IgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwMzk2IEFib3J0IGNh dXNlZCAKKyAgICAgICAgYnkgZmFpbGVkIGFsbG9jYXRpb24gZHVlIHRvIGludmFsaWQgY291bnRl ci9hdHRyCisgICAgICAgIGFuZCBjb3JyZXNwb25kaW5nOiA8cmRhcjovL3Byb2JsZW0vNjE1MjM3 MT4KKworICAgICAgICAqIGNzcy9DU1NQYXJzZXIuY3BwOgorICAgICAgICAoV2ViQ29yZTo6Q1NT UGFyc2VyOjpwYXJzZUNvdW50ZXJDb250ZW50KTogVGhlIHNwZWMgaW5kaWNhdGVzIHRoYXQgCisg ICAgICAgIG9ubHkgaWRlbnRpZmllcnMgc2hvdWxkIGJlIGFjY2VwdGVkIGhlcmUuCisKIDIwMDgt MDktMzAgIEtldmluIE1jQ3VsbG91Z2ggIDxrbWNjdWxsb3VnaEBhcHBsZS5jb20+CiAKICAgICAg ICAgUmV2aWV3ZWQgYnkgT2xpdmVyIEh1bnQuCkluZGV4OiBXZWJDb3JlL2Nzcy9DU1NQYXJzZXIu Y3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvY3NzL0NTU1BhcnNlci5jcHAJKHJldmlzaW9uIDM3 MDk5KQorKysgV2ViQ29yZS9jc3MvQ1NTUGFyc2VyLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMjY1 Nyw3ICsyNjU3LDcgQEAgUGFzc1JlZlB0cjxDU1NWYWx1ZT4gQ1NTUGFyc2VyOjpwYXJzZUNvdQog ICAgICAgICByZXR1cm4gMDsKICAgICAKICAgICBDU1NQYXJzZXJWYWx1ZSogaSA9IGFyZ3MtPmN1 cnJlbnQoKTsKLSAgICBpZiAoIShpLT51bml0ID09IENTU1ByaW1pdGl2ZVZhbHVlOjpDU1NfSURF TlQgfHwgaS0+dW5pdCA9PSBDU1NQcmltaXRpdmVWYWx1ZTo6Q1NTX05VTUJFUikpCisgICAgaWYg KGktPnVuaXQgIT0gQ1NTUHJpbWl0aXZlVmFsdWU6OkNTU19JREVOVCkKICAgICAgICAgcmV0dXJu IDA7CiAgICAgUmVmUHRyPENTU1ByaW1pdGl2ZVZhbHVlPiBpZGVudGlmaWVyID0gQ1NTUHJpbWl0 aXZlVmFsdWU6OmNyZWF0ZShpLT5zdHJpbmcsIENTU1ByaW1pdGl2ZVZhbHVlOjpDU1NfU1RSSU5H KTsKIApJbmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRl c3RzL0NoYW5nZUxvZwkocmV2aXNpb24gMzcxMjEpCisrKyBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJ KHdvcmtpbmcgY29weSkKQEAgLTEsMyArMSwxNCBAQAorMjAwOC0wOS0zMCAgQmV0aCBEYWtpbiAg PGJkYWtpbkBhcHBsZS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku CisKKyAgICAgICAgVGVzdCBmb3IgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp P2lkPTIwMzk2IEFib3J0IGNhdXNlZCAKKyAgICAgICAgYnkgZmFpbGVkIGFsbG9jYXRpb24gZHVl IHRvIGludmFsaWQgY291bnRlci9hdHRyCisgICAgICAgIGFuZCBjb3JyZXNwb25kaW5nOiA8cmRh cjovL3Byb2JsZW0vNjE1MjM3MT4KKworICAgICAgICAqIGZhc3QvY3NzL2NvdW50ZXJzL2NvdW50 ZXItbnVtYmVyLWlucHV0LWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogZmFzdC9jc3Mv Y291bnRlcnMvY291bnRlci1udW1iZXItaW5wdXQuaHRtbDogQWRkZWQuCisKIDIwMDgtMDktMzAg IENhbWVyb24gWndhcmljaCAgPHp3YXJpY2hAYXBwbGUuY29tPgogCiAgICAgICAgIFJldmlld2Vk IGJ5IEdlb2ZmIEdhcmVuLgpJbmRleDogTGF5b3V0VGVzdHMvZmFzdC9jc3MvY291bnRlcnMvY291 bnRlci1udW1iZXItaW5wdXQtZXhwZWN0ZWQudHh0Cj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3Rz L2Zhc3QvY3NzL2NvdW50ZXJzL2NvdW50ZXItbnVtYmVyLWlucHV0LWV4cGVjdGVkLnR4dAkocmV2 aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Zhc3QvY3NzL2NvdW50ZXJzL2NvdW50ZXItbnVtYmVy LWlucHV0LWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSBAQAorVGhpcyB0ZXN0 IHBhc3NlcyBpZiBpdCBkb2VzIG5vdCBjcmFzaC4KSW5kZXg6IExheW91dFRlc3RzL2Zhc3QvY3Nz L2NvdW50ZXJzL2NvdW50ZXItbnVtYmVyLWlucHV0Lmh0bWwKPT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0 VGVzdHMvZmFzdC9jc3MvY291bnRlcnMvY291bnRlci1udW1iZXItaW5wdXQuaHRtbAkocmV2aXNp b24gMCkKKysrIExheW91dFRlc3RzL2Zhc3QvY3NzL2NvdW50ZXJzL2NvdW50ZXItbnVtYmVyLWlu cHV0Lmh0bWwJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMTYgQEAKKzxodG1sPiAKKzxoZWFkPgor PHNjcmlwdD4KKyAgICBpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKQorICAgICAgICBs YXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7Cis8L3NjcmlwdD4KKzxzdHlsZSB0eXBl PSJ0ZXh0L2NzcyI+Citib2R5IHsKKyAgICBjb250ZW50OiBjb3VudGVyKC03MDM2MTY3NTU2NzM1 MjQ2MTg4KTsKK30KKzwvc3R5bGU+Cis8L2hlYWQ+Cis8Ym9keT4KKyAgICA8c3Bhbj5UaGlzIHRl c3QgcGFzc2VzIGlmIGl0IGRvZXMgbm90IGNyYXNoLgorPC9ib2R5PgorPC9odG1sPiAK