41467 2010-07-01 09:25:44 -0700 SVG Text assertion on SVGInlineTextBox 2010-10-08 10:08:41 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) PC OS X 10.5 RESOLVED FIXED http://upload.wikimedia.org/wikipedia/commons/5/51/Petra_location_map-de-2.svg P2 Normal --- 30757 1 krit webkit-unassigned commit-queue zimmermann oldest_to_newest 245383 0 krit 2010-07-01 09:25:44 -0700 The above Map asserts. Got following backtrace: ASSERTION FAILED: m_currentChunkPart.isValid() (../../WebCore/rendering/SVGInlineTextBox.cpp:599 void WebCore::SVGInlineTextBox::paintText(WebCore::GraphicsContext*, const WebCore::FloatPoint&, WebCore::RenderStyle*, WebCore::RenderStyle*, bool, bool)) Program received signal SIGSEGV, Segmentation fault. 0x00a8a481 in WebCore::SVGInlineTextBox::paintText (this=0x89e669c, context=0xbfffeac8, textOrigin=..., style=0x88f4758, selectionStyle=0x88f4758, hasSelection=false, paintSelectedTextOnly=false) at ../../WebCore/rendering/SVGInlineTextBox.cpp:599 599 ASSERT(m_currentChunkPart.isValid()); (gdb) bt #0 0x00a8a481 in WebCore::SVGInlineTextBox::paintText (this=0x89e669c, context=0xbfffeac8, textOrigin=..., style=0x88f4758, selectionStyle=0x88f4758, hasSelection=false, paintSelectedTextOnly=false) at ../../WebCore/rendering/SVGInlineTextBox.cpp:599 #1 0x00a88f86 in WebCore::SVGInlineTextBox::paint (this=0x89e669c, paintInfo=...) at ../../WebCore/rendering/SVGInlineTextBox.cpp:277 #2 0x00a87c85 in WebCore::SVGInlineFlowBox::paint (this=0x89e6744, paintInfo=...) at ../../WebCore/rendering/SVGInlineFlowBox.cpp:46 #3 0x00a92e49 in WebCore::SVGRootInlineBox::paint (this=0x8923c84, paintInfo=...) at ../../WebCore/rendering/SVGRootInlineBox.cpp:54 #4 0x008fa76e in WebCore::RenderLineBoxList::paint (this=0x88fae30, renderer=0x88fadc4, paintInfo=..., tx=304, ty=1572) at ../../WebCore/rendering/RenderLineBoxList.cpp:219 #5 0x0087c5f7 in WebCore::RenderBlock::paintContents (this=0x88fadc4, paintInfo=..., tx=304, ty=1572) at ../../WebCore/rendering/RenderBlock.cpp:2089 #6 0x0087cea3 in WebCore::RenderBlock::paintObject (this=0x88fadc4, paintInfo=..., tx=304, ty=1572) at ../../WebCore/rendering/RenderBlock.cpp:2194 #7 0x0087bea3 in WebCore::RenderBlock::paint (this=0x88fadc4, paintInfo=..., tx=304, ty=1572) at ../../WebCore/rendering/RenderBlock.cpp:1980 #8 0x00a83bbc in WebCore::RenderSVGText::paint (this=0x88fadc4, paintInfo=...) at ../../WebCore/rendering/RenderSVGText.cpp:161 #9 0x00a65e46 in WebCore::RenderSVGContainer::paint (this=0x88f0d44, paintInfo=...) at ../../WebCore/rendering/RenderSVGContainer.cpp:104 #10 0x008ae9d1 in WebCore::RenderBox::paint (this=0x86fa02c, paintInfo=..., tx=0, ty=0) at ../../WebCore/rendering/RenderBox.cpp:574 #11 0x00a81a6f in WebCore::RenderSVGRoot::paint (this=0x86fa02c, paintInfo=..., parentX=0, parentY=0) at ../../WebCore/rendering/RenderSVGRoot.cpp:179 #12 0x008ee8b6 in WebCore::RenderLayer::paintLayer (this=0x86f9044, rootLayer=0x8150dbc, p=0xbfffeac8, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, overlapTestRequests=0xbfffe90c, paintFlags=0) at ../../WebCore/rendering/RenderLayer.cpp:2445 #13 0x008eec65 in WebCore::RenderLayer::paintList (this=0x8150dbc, list=0x86ead70, rootLayer=0x8150dbc, p=0xbfffeac8, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, overlapTestRequests=0xbfffe90c, paintFlags=0) at ../../WebCore/rendering/RenderLayer.cpp:2498 #14 0x008eea76 in WebCore::RenderLayer::paintLayer (this=0x8150dbc, rootLayer=0x8150dbc, p=0xbfffeac8, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, overlapTestRequests=0xbfffe90c, paintFlags=0) at ../../WebCore/rendering/RenderLayer.cpp:2466 #15 0x008eddaa in WebCore::RenderLayer::paint (this=0x8150dbc, p=0xbfffeac8, damageRect=..., paintBehavior=0, paintingRoot=0x0) at ../../WebCore/rendering/RenderLayer.cpp:2251 #16 0x00769209 in WebCore::FrameView::paintContents (this=0x81583a8, p=0xbfffeac8, rect=...) at ../../WebCore/page/FrameView.cpp:1941 #17 0x007d2de4 in WebCore::ScrollView::paint (this=0x81583a8, context=0xbfffeac8, rect=...) at ../../WebCore/platform/ScrollView.cpp:797 245797 1 60345 zimmermann 2010-07-02 00:47:07 -0700 Created attachment 60345 Funny reduction 290238 2 zimmermann 2010-10-06 05:44:49 -0700 Fixed in trunk, someone needs to land the reduction as new test, to make sure we'll never see the assertion again. 291052 3 70095 rhodovan.u-szeged 2010-10-07 09:27:52 -0700 Created attachment 70095 Adding layout test for checking SVG Text assertion 291134 4 krit 2010-10-07 10:56:24 -0700 The ChangeLog should mention why he assert was thrown. IIRC it was about the missing glyph tag on chunk borders in combination with a space char. I let the review to Niko, but the ChangeLog should really mention the reason for the assert, even if we don't hit the assert anymore. 291480 5 70095 zimmermann 2010-10-08 00:26:17 -0700 Comment on attachment 70095 Adding layout test for checking SVG Text assertion View in context: https://bugs.webkit.org/attachment.cgi?id=70095&action=review > LayoutTests/ChangeLog:8 > + Adding layout test for checking SVG Text assertion. Example: <text><tspan>S</tspan><tspan>O</tspan></text> The old SVG text engine fired an assertion, when the glyph 'O' isn't present in the <font>, but only if a <missing-glyph> element is included in the SVG <font>. <tspan>SO</tspan> didn't trigger that assertion. Adding a new layout test, to make sure we never see the assertion again. > LayoutTests/svg/text/text-assert.svg:8 > + <font> > + <font-face font-family="Arial"/> > + <missing-glyph/> > + <glyph horiz-adv-x="667" unicode="S" d="M40 230z"/> > + </font> Can you reindent here, with 4 spaces? > LayoutTests/svg/text/text-assert.svg:11 > +<!-- Assertion triggers only if <missing-glyph> element above is included and only if a nonexistant glyph is referenced in a _second_ tspan. Moving the 'o' next to the 'S' just works. Weird.--> I'd change the comment, as it no longer applies: <!-- The old SVG text engine fired an assertion, if the <missing-glyph> element is included in the <font> and if a nonexistant glyph is referenced in a different tspan. Moving the 'o' next to the 'S' doesn't trigger it. --> > LayoutTests/svg/text/text-assert.svg:12 > +<text style="font-family: Helvetica" y="158" x="311.00006"><tspan>S</tspan><tspan>o</tspan></text> Just use x="10" y="20". > LayoutTests/svg/text/text-assert.svg:14 > +<text y="30">If you see "So" the test passed.</text> y="50" here. Hopefully you can commit soon, for now you need to upload a new version, sorry :( 291706 6 70261 rhodovan.u-szeged 2010-10-08 09:33:49 -0700 Created attachment 70261 Adding layout test for checking SVG Text assertion 291714 7 70261 zimmermann 2010-10-08 09:49:20 -0700 Comment on attachment 70261 Adding layout test for checking SVG Text assertion Great, thanks! 291734 8 70261 commit-queue 2010-10-08 10:08:36 -0700 Comment on attachment 70261 Adding layout test for checking SVG Text assertion Clearing flags on attachment: 70261 Committed r69410: <http://trac.webkit.org/changeset/69410> 291735 9 commit-queue 2010-10-08 10:08:41 -0700 All reviewed patches have been landed. Closing bug. 60345 2010-07-02 00:47:07 -0700 2010-07-02 00:47:07 -0700 Funny reduction petraCrash.svg image/svg+xml 533 zimmermann PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+Cjxz dmcgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPGRlZnM+Cgk8Zm9udD4KCQk8 Zm9udC1mYWNlIGZvbnQtZmFtaWx5PSJBcmlhbCIvPgoJCTxtaXNzaW5nLWdseXBoLz4KCQk8Z2x5 cGggaG9yaXotYWR2LXg9IjY2NyIgdW5pY29kZT0iUyIgZD0iTTQwIDIzMHoiLz4KCTwvZm9udD4K PC9kZWZzPgoKPCEtLSBBc3NlcnRpb24gdHJpZ2dlcnMgb25seSBpZiA8bWlzc2luZy1nbHlwaD4g ZWxlbWVudCBhYm92ZSBpcyBpbmNsdWRlZCBhbmQgb25seSBpZiBhIG5vbmV4aXN0YW50IGdseXBo IGlzIHJlZmVyZW5jZWQgaW4gYSBfc2Vjb25kXyB0c3Bhbi4gTW92aW5nIHRoZSAnbycgbmV4dCB0 byB0aGUgJ1MnIGp1c3Qgd29ya3MuIFdlaXJkLi0tPgo8dGV4dCBzdHlsZT0iZm9udC1mYW1pbHk6 IEFyaWFsIiB5PSIxNTgiIHg9IjMxMS4wMDAwNiI+PHRzcGFuPlM8L3RzcGFuPjx0c3Bhbj5vPC90 c3Bhbj48L3RleHQ+Cjwvc3ZnPgo= 70095 2010-10-07 09:27:52 -0700 2010-10-08 09:33:49 -0700 Adding layout test for checking SVG Text assertion textAssert.patch text/plain 1889 rhodovan.u-szeged SW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9D aGFuZ2VMb2cJKHJldmlzaW9uIDY5MzExKQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3Jr aW5nIGNvcHkpCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTAtMTAtMDcgIFJlbmF0YSBIb2RvdmFuICA8 cmVuaUBpbmYudS1zemVnZWQuaHU+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgU1ZHIFRleHQgYXNzZXJ0aW9uIG9uIFNWR0lubGluZVRleHRCb3guCisg ICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD00MTQ2NworCisg ICAgICAgIEFkZGluZyBsYXlvdXQgdGVzdCBmb3IgY2hlY2tpbmcgU1ZHIFRleHQgYXNzZXJ0aW9u LgorCisgICAgICAgICogc3ZnL3RleHQvdGV4dC1hc3NlcnQtZXhwZWN0ZWQudHh0OiBBZGRlZC4K KyAgICAgICAgKiBzdmcvdGV4dC90ZXh0LWFzc2VydC5zdmc6IEFkZGVkLgorCiAyMDEwLTEwLTA3 ICBOaWtvbGFzIFppbW1lcm1hbm4gIDxuemltbWVybWFubkByaW0uY29tPgogCiAgICAgICAgIFJl dmlld2VkIGJ5IERpcmsgU2NodWx6ZS4KSW5kZXg6IExheW91dFRlc3RzL3N2Zy90ZXh0L3RleHQt YXNzZXJ0LWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9zdmcvdGV4dC90 ZXh0LWFzc2VydC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9zdmcv dGV4dC90ZXh0LWFzc2VydC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMiBA QAorU28KK0lmIHlvdSBzZWUgIlNvIiB0aGUgdGVzdCBwYXNzZWQuCkluZGV4OiBMYXlvdXRUZXN0 cy9zdmcvdGV4dC90ZXh0LWFzc2VydC5zdmcKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvc3Zn L3RleHQvdGV4dC1hc3NlcnQuc3ZnCShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvc3ZnL3Rl eHQvdGV4dC1hc3NlcnQuc3ZnCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDIxIEBACis8P3htbCB2 ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJVVEYtOCI/PgorPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53 My5vcmcvMjAwMC9zdmciPgorPGRlZnM+CisgICAgPGZvbnQ+CisJPGZvbnQtZmFjZSBmb250LWZh bWlseT0iQXJpYWwiLz4KKwk8bWlzc2luZy1nbHlwaC8+CisJPGdseXBoIGhvcml6LWFkdi14PSI2 NjciIHVuaWNvZGU9IlMiIGQ9Ik00MCAyMzB6Ii8+CisgICAgPC9mb250PgorPC9kZWZzPgorCis8 IS0tIEFzc2VydGlvbiB0cmlnZ2VycyBvbmx5IGlmIDxtaXNzaW5nLWdseXBoPiBlbGVtZW50IGFi b3ZlIGlzIGluY2x1ZGVkIGFuZCBvbmx5IGlmIGEgbm9uZXhpc3RhbnQgZ2x5cGggaXMgcmVmZXJl bmNlZCBpbiBhIF9zZWNvbmRfIHRzcGFuLiBNb3ZpbmcgdGhlICdvJyBuZXh0IHRvIHRoZSAnUycg anVzdCB3b3Jrcy4gV2VpcmQuLS0+Cis8dGV4dCBzdHlsZT0iZm9udC1mYW1pbHk6IEhlbHZldGlj YSIgeT0iMTU4IiB4PSIzMTEuMDAwMDYiPjx0c3Bhbj5TPC90c3Bhbj48dHNwYW4+bzwvdHNwYW4+ PC90ZXh0PgorCis8dGV4dCB5PSIzMCI+SWYgeW91IHNlZSAiU28iIHRoZSB0ZXN0IHBhc3NlZC48 L3RleHQ+CisKKzxzY3JpcHQ+CisgICAgaWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikK KyAgICAgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4dCgpOworPC9zY3JpcHQ+CisK Kzwvc3ZnPgo= 70261 2010-10-08 09:33:49 -0700 2010-10-08 10:08:36 -0700 Adding layout test for checking SVG Text assertion textAssert.patch text/plain 2251 rhodovan.u-szeged SW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9D aGFuZ2VMb2cJKHJldmlzaW9uIDY5NDA0KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3Jr aW5nIGNvcHkpCkBAIC0xLDMgKzEsMTggQEAKKzIwMTAtMTAtMDggIFJlbmF0YSBIb2RvdmFuICA8 cmVuaUBpbmYudS1zemVnZWQuaHU+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgU1ZHIFRleHQgYXNzZXJ0aW9uIG9uIFNWR0lubGluZVRleHRCb3guCisg ICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD00MTQ2NworCisg ICAgICAgIEV4YW1wbGU6IDx0ZXh0Pjx0c3Bhbj5TPC90c3Bhbj48dHNwYW4+TzwvdHNwYW4+PC90 ZXh0PiBUaGUgb2xkIFNWRyB0ZXh0IGVuZ2luZSBmaXJlZCBhbiBhc3NlcnRpb24sCisgICAgICAg IHdoZW4gdGhlIGdseXBoICdPJyBpc24ndCBwcmVzZW50IGluIHRoZSA8Zm9udD4sIGJ1dCBvbmx5 IGlmIGEgPG1pc3NpbmctZ2x5cGg+IGVsZW1lbnQgaXMgaW5jbHVkZWQKKyAgICAgICAgaW4gdGhl IFNWRyA8Zm9udD4uIDx0c3Bhbj5TTzwvdHNwYW4+IGRpZG4ndCB0cmlnZ2VyIHRoYXQgYXNzZXJ0 aW9uLiBBZGRpbmcgYSBuZXcgbGF5b3V0IHRlc3QsIHRvCisgICAgICAgIG1ha2Ugc3VyZSB3ZSBu ZXZlciBzZWUgdGhlIGFzc2VydGlvbiBhZ2Fpbi4KKworICAgICAgICAqIHN2Zy90ZXh0L3RleHQt YXNzZXJ0LWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogc3ZnL3RleHQvdGV4dC1hc3Nl cnQuc3ZnOiBBZGRlZC4KKwogMjAxMC0xMC0wOCAgTmlrb2xhcyBaaW1tZXJtYW5uICA8bnppbW1l cm1hbm5AcmltLmNvbT4KIAogICAgICAgICBOb3QgcmV2aWV3ZWQuCkluZGV4OiBMYXlvdXRUZXN0 cy9zdmcvdGV4dC90ZXh0LWFzc2VydC1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0 VGVzdHMvc3ZnL3RleHQvdGV4dC1hc3NlcnQtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQorKysg TGF5b3V0VGVzdHMvc3ZnL3RleHQvdGV4dC1hc3NlcnQtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAw KQpAQCAtMCwwICsxLDIgQEAKK1NvCitJZiB5b3Ugc2VlICJTbyIgdGhlIHRlc3QgcGFzc2VkLgpJ bmRleDogTGF5b3V0VGVzdHMvc3ZnL3RleHQvdGV4dC1hc3NlcnQuc3ZnCj09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0t IExheW91dFRlc3RzL3N2Zy90ZXh0L3RleHQtYXNzZXJ0LnN2ZwkocmV2aXNpb24gMCkKKysrIExh eW91dFRlc3RzL3N2Zy90ZXh0L3RleHQtYXNzZXJ0LnN2ZwkocmV2aXNpb24gMCkKQEAgLTAsMCAr MSwyNSBAQAorPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KKzxzdmcgeG1s bnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KKzxkZWZzPgorICAgIDxmb250PgorICAg ICAgICA8Zm9udC1mYWNlIGZvbnQtZmFtaWx5PSJBcmlhbCIvPgorICAgICAgICA8bWlzc2luZy1n bHlwaC8+CisgICAgICAgIDxnbHlwaCBob3Jpei1hZHYteD0iNjY3IiB1bmljb2RlPSJTIiBkPSJN NDAgMjMweiIvPgorICAgIDwvZm9udD4KKzwvZGVmcz4KKworPCEtLSAKKyAgICBUaGUgb2xkIFNW RyB0ZXh0IGVuZ2luZSBmaXJlZCBhbiBhc3NlcnRpb24sIGlmIHRoZSA8bWlzc2luZy1nbHlwaD4g ZWxlbWVudCBpcyBpbmNsdWRlZAorICAgIGluIHRoZSA8Zm9udD4gYW5kIGlmIGEgbm9uZXhpc3Rh bnQgZ2x5cGggaXMgcmVmZXJlbmNlZCBpbiBhIGRpZmZlcmVudCB0c3Bhbi4gCisgICAgTW92aW5n IHRoZSAnbycgbmV4dCB0byB0aGUgJ1MnIGRvZXNuJ3QgdHJpZ2dlciBpdC4KKy0tPgorPHRleHQg c3R5bGU9ImZvbnQtZmFtaWx5OiBIZWx2ZXRpY2EiIHg9IjEwIiB5PSIyMCI+PHRzcGFuPlM8L3Rz cGFuPjx0c3Bhbj5vPC90c3Bhbj48L3RleHQ+CisKKzx0ZXh0IHk9IjUwIj5JZiB5b3Ugc2VlICJT byIgdGhlIHRlc3QgcGFzc2VkLjwvdGV4dD4KKworPHNjcmlwdD4KKyAgICBpZiAod2luZG93Lmxh eW91dFRlc3RDb250cm9sbGVyKQorICAgICAgICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNU ZXh0KCk7Cis8L3NjcmlwdD4KKworPC9zdmc+Cg==