31574 2009-11-16 20:18:54 -0800 Crashing bug when removing <ruby> element 2009-12-02 19:26:03 -0800 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) All All RESOLVED FIXED P1 Normal --- 1 rolandsteiner rolandsteiner eric hamaji oldest_to_newest 164143 0 rolandsteiner 2009-11-16 20:18:54 -0800 Found by Shinichiro Hamaji. The renderer crashes if a <ruby> tag is being deleted via JavaScript. The example given was: <div id="t"><ruby>f</div> <script>t.innerHTML = '';</script> 164146 1 43341 rolandsteiner 2009-11-16 21:01:05 -0800 Created attachment 43341 patch - fix crash Cause of the bug: 1.) RenderBlock::destroy() of the RenderRubyRun called destroyLeftoverChildren() 2.) that called destroy() of the RenderRubyBase(), which in RenderObject::destroy() calls remove() 3.) remove() is being redirected as parent()->removeChild() in RenderObject.h 4.) this triggers the special handling of child removal in RenderRubyRun that causes it to destroy itself 5.) On returning from all this the renderer crashes when accessing a member or virtual function on this now illegal object. I therefore added a flag that tracks if the ruby run is being destroyed. If so, avoid doing the special handling in removeChild that caused this. It's not the most elegant solution, but the easiest to implement without touching unrelated code. Also, it's self-documenting. 164458 2 rolandsteiner 2009-11-17 22:36:06 -0800 The bug may also be triggered by the code that handles invalid HTML markup rather than just JavaScript. Updated to P1 as it's a crashing bug. 164690 3 43341 eric 2009-11-18 13:39:39 -0800 Comment on attachment 43341 patch - fix crash I'm not well enough versed with the ruby code to understand why the ruby classes need this special memory management. How does RenderRubyRun relate to RenderInline for instance? Does RenderInline use a similar m_beingDestroyed method? I'm missing enough context to understand why this fix is the right fix. 164756 4 43341 darin 2009-11-18 15:20:54 -0800 Comment on attachment 43341 patch - fix crash I agree that there are probably more elegant fixes. But this should do, at least for now. r=me 164888 5 rolandsteiner 2009-11-18 20:51:33 -0800 committed in r51169 168115 6 eric 2009-12-02 12:00:30 -0800 There are several tools which can auto-close the bugs for you. bugzilla-tool land-diff is one of them. :) mark-bug-fixed is another. 168231 7 rolandsteiner 2009-12-02 19:26:03 -0800 (In reply to comment #6) Thanks, good to know! I assumed that bugs needed verification that they are indeed fixed. 43341 2009-11-16 21:01:05 -0800 2009-11-18 15:20:54 -0800 patch - fix crash ruby-fixcrash.patch text/plain 5990 rolandsteiner SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA1MTA2MikKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMzIgQEAKKzIwMDktMTEtMTYgIFJvbGFuZCBTdGVpbmVyICA8cm9sYW5kc3RlaW5l ckBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisK KyAgICAgICAgQnVnIDMxNTc0IC0gIENyYXNoaW5nIGJ1ZyB3aGVuIHJlbW92aW5nIDxydWJ5PiBp biBKYXZhU2NyaXB0CisgICAgICAgIChodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j Z2k/aWQ9MzE1NzQpCisKKyAgICAgICAgQ2F1c2Ugb2YgdGhlIGJ1ZzoKKyAgICAgICAgMS4pIFJl bmRlckJsb2NrOjpkZXN0cm95KCkgb2YgdGhlIFJlbmRlclJ1YnlSdW4gY2FsbGVkIGRlc3Ryb3lM ZWZ0b3ZlckNoaWxkcmVuKCkKKyAgICAgICAgMi4pIHRoYXQgY2FsbGVkIGRlc3Ryb3koKSBvZiB0 aGUgUmVuZGVyUnVieUJhc2UoKSwgd2hpY2ggaW4gUmVuZGVyT2JqZWN0OjpkZXN0cm95KCkgY2Fs bHMgcmVtb3ZlKCkKKyAgICAgICAgMy4pIHJlbW92ZSgpIGlzIGJlaW5nIHJlZGlyZWN0ZWQgYXMg cGFyZW50KCktPnJlbW92ZUNoaWxkKCkgaW4gUmVuZGVyT2JqZWN0LmgKKyAgICAgICAgNC4pIHRo aXMgdHJpZ2dlcnMgdGhlIHNwZWNpYWwgaGFuZGxpbmcgb2YgY2hpbGQgcmVtb3ZhbCBpbiBSZW5k ZXJSdWJ5UnVuIHRoYXQKKyAgICAgICAgICAgIGNhdXNlcyBpdCB0byBkZXN0cm95IGl0c2VsZgor ICAgICAgICA1LikgT24gcmV0dXJuaW5nIGZyb20gYWxsIHRoaXMgdGhlIHJlbmRlcmVyIGNyYXNo ZXMgd2hlbiBhY2Nlc3NpbmcgYSBtZW1iZXIKKyAgICAgICAgICAgIG9yIHZpcnR1YWwgZnVuY3Rp b24gb24gdGhpcyBub3cgaWxsZWdhbCBvYmplY3QuCisKKyAgICAgICAgSSB0aGVyZWZvcmUgYWRk ZWQgYSBmbGFnIHRoYXQgdHJhY2tzIGlmIHRoZSBydWJ5IHJ1biBpcyBiZWluZyBkZXN0cm95ZWQu CisgICAgICAgIElmIHNvLCBhdm9pZCBkb2luZyB0aGUgc3BlY2lhbCBoYW5kbGluZyBpbiByZW1v dmVDaGlsZCB0aGF0IGNhdXNlZCB0aGlzLgorICAgICAgICBJdCdzIG5vdCB0aGUgbW9zdCBlbGVn YW50IHNvbHV0aW9uLCBidXQgdGhlIGVhc2llc3QgdG8gaW1wbGVtZW50IHdpdGhvdXQKKyAgICAg ICAgdG91Y2hpbmcgdW5yZWxhdGVkIGNvZGUuIEFsc28sIGl0J3Mgc2VsZi1kb2N1bWVudGluZy4K KworICAgICAgICBUZXN0OiBmYXN0L3J1YnkvcnVieS1yZW1vdmUuaHRtbAorCisgICAgICAgICog cmVuZGVyaW5nL1JlbmRlclJ1YnlSdW4uY3BwOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVyUnVi eVJ1bjo6UmVuZGVyUnVieVJ1bik6CisgICAgICAgIChXZWJDb3JlOjpSZW5kZXJSdWJ5UnVuOjpk ZXN0cm95KToKKyAgICAgICAgKFdlYkNvcmU6OlJlbmRlclJ1YnlSdW46OnJlbW92ZUNoaWxkKToK KyAgICAgICAgKiByZW5kZXJpbmcvUmVuZGVyUnVieVJ1bi5oOgorCiAyMDA5LTExLTE2ICBBbGV4 ZXkgUHJvc2t1cnlha292ICA8YXBAYXBwbGUuY29tPgogCiAgICAgICAgIEZpeCBhIHR5cG8gaW4g cHJldmlvdXMgY29tbWl0LgpJbmRleDogV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyUnVieVJ1bi5j cHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyUnVieVJ1bi5jcHAJKHJl dmlzaW9uIDUxMDA2KQorKysgV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyUnVieVJ1bi5jcHAJKHdv cmtpbmcgY29weSkKQEAgLTQxLDYgKzQxLDcgQEAgbmFtZXNwYWNlIFdlYkNvcmUgewogCiBSZW5k ZXJSdWJ5UnVuOjpSZW5kZXJSdWJ5UnVuKE5vZGUqIG5vZGUpCiAgICAgOiBSZW5kZXJCbG9jayhu b2RlKQorICAgICwgbV9iZWluZ0Rlc3Ryb3llZChmYWxzZSkKIHsKICAgICBzZXRSZXBsYWNlZCh0 cnVlKTsKICAgICBzZXRJbmxpbmUodHJ1ZSk7CkBAIC01MCw2ICs1MSwxMyBAQCBSZW5kZXJSdWJ5 UnVuOjp+UmVuZGVyUnVieVJ1bigpCiB7CiB9CiAKK3ZvaWQgUmVuZGVyUnVieVJ1bjo6ZGVzdHJv eSgpCit7CisgICAgLy8gTWFyayBpZiB0aGUgcnVuIGlzIGJlaW5nIGRlc3Ryb3llZCB0byBhdm9p ZCB0cm91YmxlIGluIHJlbW92ZUNoaWxkKCkuCisgICAgbV9iZWluZ0Rlc3Ryb3llZCA9IHRydWU7 CisgICAgUmVuZGVyQmxvY2s6OmRlc3Ryb3koKTsKK30KKwogYm9vbCBSZW5kZXJSdWJ5UnVuOjpo YXNSdWJ5VGV4dCgpIGNvbnN0CiB7CiAgICAgLy8gVGhlIG9ubHkgcGxhY2Ugd2hlcmUgYSBydWJ5 IHRleHQgY2FuIGJlIGlzIGluIHRoZSBmaXJzdCBwb3NpdGlvbgpAQCAtMTU1LDcgKzE2Myw3IEBA IHZvaWQgUmVuZGVyUnVieVJ1bjo6cmVtb3ZlQ2hpbGQoUmVuZGVyT2IKIHsKICAgICAvLyBJZiB0 aGUgY2hpbGQgaXMgYSBydWJ5IHRleHQsIHRoZW4gbWVyZ2UgdGhlIHJ1YnkgYmFzZSB3aXRoIHRo ZSBiYXNlIG9mCiAgICAgLy8gdGhlIHJpZ2h0IHNpYmxpbmcgcnVuLCBpZiBwb3NzaWJsZS4KLSAg ICBpZiAoIWRvY3VtZW50QmVpbmdEZXN0cm95ZWQoKSAmJiBjaGlsZC0+aXNSdWJ5VGV4dCgpKSB7 CisgICAgaWYgKCFtX2JlaW5nRGVzdHJveWVkICYmICFkb2N1bWVudEJlaW5nRGVzdHJveWVkKCkg JiYgY2hpbGQtPmlzUnVieVRleHQoKSkgewogICAgICAgICBSZW5kZXJSdWJ5QmFzZSogYmFzZSA9 IHJ1YnlCYXNlKCk7CiAgICAgICAgIFJlbmRlck9iamVjdCogcmlnaHROZWlnaGJvdXIgPSBuZXh0 U2libGluZygpOwogICAgICAgICBpZiAoYmFzZSAmJiByaWdodE5laWdoYm91ciAmJiByaWdodE5l aWdoYm91ci0+aXNSdWJ5UnVuKCkpIHsKQEAgLTE2OSw3ICsxNzcsNyBAQCB2b2lkIFJlbmRlclJ1 YnlSdW46OnJlbW92ZUNoaWxkKFJlbmRlck9iCiAKICAgICBSZW5kZXJCbG9jazo6cmVtb3ZlQ2hp bGQoY2hpbGQpOwogCi0gICAgaWYgKCFkb2N1bWVudEJlaW5nRGVzdHJveWVkKCkpIHsKKyAgICBp ZiAoIW1fYmVpbmdEZXN0cm95ZWQgJiYgIWRvY3VtZW50QmVpbmdEZXN0cm95ZWQoKSkgewogICAg ICAgICAvLyBDaGVjayBpZiBvdXIgYmFzZSAoaWYgYW55KSBpcyBub3cgZW1wdHkuIElmIHNvLCBk ZXN0cm95IGl0LgogICAgICAgICBSZW5kZXJCbG9jayogYmFzZSA9IHJ1YnlCYXNlKCk7CiAgICAg ICAgIGlmIChiYXNlICYmICFiYXNlLT5maXJzdENoaWxkKCkpIHsKQEAgLTE3OCw3ICsxODYsNyBA QCB2b2lkIFJlbmRlclJ1YnlSdW46OnJlbW92ZUNoaWxkKFJlbmRlck9iCiAgICAgICAgICAgICBi YXNlLT5kZXN0cm95KCk7CiAgICAgICAgIH0KIAotICAgICAgICAvLyBJZiBhbnkgb2YgdGhlIGFi b3ZlIGxlYXZlcyB0aGUgcnVuIGVtcHR5LCBkZXN0cm95IGl0IGFzIHdlbGwKKyAgICAgICAgLy8g SWYgYW55IG9mIHRoZSBhYm92ZSBsZWF2ZXMgdGhlIHJ1biBlbXB0eSwgZGVzdHJveSBpdCBhcyB3 ZWxsLgogICAgICAgICBpZiAoaXNFbXB0eSgpKSB7CiAgICAgICAgICAgICBwYXJlbnQoKS0+cmVt b3ZlQ2hpbGQodGhpcyk7CiAgICAgICAgICAgICBkZWxldGVMaW5lQm94VHJlZSgpOwpJbmRleDog V2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyUnVieVJ1bi5oCj09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUv cmVuZGVyaW5nL1JlbmRlclJ1YnlSdW4uaAkocmV2aXNpb24gNTEwMDYpCisrKyBXZWJDb3JlL3Jl bmRlcmluZy9SZW5kZXJSdWJ5UnVuLmgJKHdvcmtpbmcgY29weSkKQEAgLTQ2LDYgKzQ2LDggQEAg cHVibGljOgogICAgIFJlbmRlclJ1YnlSdW4oTm9kZSopOwogICAgIHZpcnR1YWwgflJlbmRlclJ1 YnlSdW4oKTsKIAorICAgIHZpcnR1YWwgdm9pZCBkZXN0cm95KCk7CisKICAgICB2aXJ0dWFsIGNv bnN0IGNoYXIqIHJlbmRlck5hbWUoKSBjb25zdCB7IHJldHVybiAiUmVuZGVyUnVieVJ1biAoYW5v bnltb3VzKSI7IH0KIAogICAgIHZpcnR1YWwgYm9vbCBpc1J1YnlSdW4oKSBjb25zdCB7IHJldHVy biB0cnVlOyB9CkBAIC02OCw2ICs3MCw5IEBAIHB1YmxpYzoKIAogcHJvdGVjdGVkOgogICAgIFJl bmRlclJ1YnlCYXNlKiBjcmVhdGVSdWJ5QmFzZSgpIGNvbnN0OworICAgIAorcHJpdmF0ZToKKyAg ICBib29sIG1fYmVpbmdEZXN0cm95ZWQ7CiB9OwogCiB9IC8vIG5hbWVzcGFjZSBXZWJDb3JlCklu ZGV4OiBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvQ2hh bmdlTG9nCShyZXZpc2lvbiA1MTA2MikKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29ya2lu ZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBACisyMDA5LTExLTE2ICBSb2xhbmQgU3RlaW5lciAgPHJv bGFuZHN0ZWluZXJAY2hyb21pdW0ub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgIEJ1ZyAzMTU3NCAtICBDcmFzaGluZyBidWcgd2hlbiByZW1vdmlu ZyA8cnVieT4gaW4gSmF2YVNjcmlwdAorICAgICAgICAoaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTMxNTc0KQorICAgICAgICAKKyAgICAgICAgTGF5b3V0IHRlc3QgdG8g dmVyaWZ5IGl0IG5vIGxvbmdlciBjcmFzaGVzIHdoZW4gdGhlIDxydWJ5PiBlbGVtZW50CisgICAg ICAgIGlzIGJlaW5nIHJlbW92ZWQuCisKKyAgICAgICAgKiBmYXN0L3J1YnkvcnVieS1yZW1vdmUt ZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L3J1YnkvcnVieS1yZW1vdmUuaHRt bDogQWRkZWQuCisKIDIwMDktMTEtMTYgIEFsZXhleSBQcm9za3VyeWFrb3YgIDxhcEBhcHBsZS5j b20+CiAKICAgICAgICAgRGlzYWJsaW5nIFdlYlNvY2tldCB0ZXN0cyBvbiBUaWdlciBhbmQgV2lu ZG93cyBhZ2FpbiwgYXMgdGhleSBzdGlsbCB0aW1lIG91dC4KSW5kZXg6IExheW91dFRlc3RzL2Zh c3QvcnVieS9ydWJ5LXJlbW92ZS1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVz dHMvZmFzdC9ydWJ5L3J1YnktcmVtb3ZlLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKKysrIExh eW91dFRlc3RzL2Zhc3QvcnVieS9ydWJ5LXJlbW92ZS1leHBlY3RlZC50eHQJKHJldmlzaW9uIDAp CkBAIC0wLDAgKzEgQEAKK1NVQ0NFU1MhCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0L3J1YnkvcnVi eS1yZW1vdmUuaHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L3J1YnkvcnVieS1y ZW1vdmUuaHRtbAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Zhc3QvcnVieS9ydWJ5LXJl bW92ZS5odG1sCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDE4IEBACis8aHRtbD4KKzxoZWFkPgor PHNjcmlwdD4KK2Z1bmN0aW9uIHRlc3QoKQoreworICAgIGlmICh3aW5kb3cubGF5b3V0VGVzdENv bnRyb2xsZXIpCisgICAgICAgIGxheW91dFRlc3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKKyAg ICB2YXIgcnVieSA9IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJ0Iik7CisgICAgcnVieS5pbm5l ckhUTUwgPSAnJzsgLy8gVGhpcyBsaW5lIG11c3RuJ3QgY3Jhc2ggCisgICAgZG9jdW1lbnQuZ2V0 RWxlbWVudEJ5SWQoInJlc3VsdCIpLmZpcnN0Q2hpbGQuZGF0YSA9ICdTVUNDRVNTISc7Cit9Cis8 L3NjcmlwdD4KKzwvaGVhZD4KKzxib2R5IG9ubG9hZD0idGVzdCgpIj4KKzxkaXYgaWQ9InQiPjxy dWJ5PmY8L2Rpdj4KKzxkaXYgaWQ9InJlc3VsdCI+RkFJTEVEITwvZGl2PgorPC9ib2R5PgorPC9o dG1sPgo=