41931 2010-07-08 22:47:52 -0700 svg/custom/use-instanceRoot-event-bubbling.xhtml test crashes 2010-07-09 03:51:53 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) PC OS X 10.5 RESOLVED FIXED P2 Normal --- 1 simon.fraser zimmermann zimmermann oldest_to_newest 248749 0 simon.fraser 2010-07-08 22:47:52 -0700 The svg/custom/use-instanceRoot-event-bubbling.xhtml test is crashing on the bots, and also for me. 248751 1 simon.fraser 2010-07-08 22:48:21 -0700 It asserts at: 0 com.apple.WebCore 0x00000001011a2561 WebCore::FrameView::layout(bool) + 3101 (FrameView.cpp:808) 1 com.apple.WebCore 0x00000001011a29f7 WebCore::FrameView::forceLayout(bool) + 29 (FrameView.cpp:2027) 2 com.apple.WebKit 0x00000001008e4d7a -[WebHTMLView layoutToMinimumPageWidth:maximumPageWidth:adjustingViewSize:] + 231 (WebHTMLView.mm:3129) 3 com.apple.WebKit 0x00000001008d70e8 -[WebHTMLView layout] + 43 (WebHTMLView.mm:3143) 4 DumpRenderTree 0x0000000100016450 -[EventSendingController mouseDown:withModifiers:] + 96 (EventSendingController.mm:318) 5 com.apple.CoreFoundation 0x00007fff8016fd2c __invoking___ + 140 6 com.apple.CoreFoundation 0x00007fff8016fbfd -[NSInvocation invoke] + 141 7 com.apple.WebCore 0x0000000101685526 JSC::Bindings::ObjcInstance::invokeObjcMethod(JSC::ExecState*, JSC::Bindings::ObjcMethod*) + 1320 (objc_instance.mm:299) 8 com.apple.WebCore 0x000000010168581e JSC::Bindings::ObjcInstance::invokeMethod(JSC::ExecState*, JSC::RuntimeMethod*) + 288 (objc_instance.mm:208) 9 com.apple.WebCore 0x000000010182a0af JSC::callRuntimeMethod(JSC::ExecState*) + 404 (runtime_method.cpp:117) 10 com.apple.JavaScriptCore 0x00000001001bf01b cti_op_call_NotJSFunction + 450 (JITStubs.cpp:2066) 11 com.apple.JavaScriptCore 0x00000001001b7961 jscGeneratedNativeCode + 0 (JITStubs.cpp:998) 12 com.apple.JavaScriptCore 0x0000000100197a9a JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*, JSC::JSValue*) + 76 (JITCode.h:77) 13 com.apple.JavaScriptCore 0x0000000100194523 JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::ScopeChainNode*, JSC::JSObject*, JSC::JSValue*) + 977 (Interpreter.cpp:703) 14 com.apple.JavaScriptCore 0x0000000100166aa5 JSC::evaluate(JSC::ExecState*, JSC::ScopeChain&, JSC::SourceCode const&, JSC::JSValue) + 484 (Completion.cpp:63) 15 com.apple.WebCore 0x0000000101476832 WebCore::JSMainThreadExecState::evaluate(JSC::ExecState*, JSC::ScopeChain&, JSC::SourceCode const&, JSC::JSValue) + 58 (JSMainThreadExecState.h:54) 16 com.apple.WebCore 0x0000000101839cd6 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld*, WebCore::ShouldAllowXSS) + 514 (ScriptController.cpp:151) 17 com.apple.WebCore 0x0000000101839ee0 WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&, WebCore::ShouldAllowXSS) + 58 (ScriptController.cpp:178) 18 com.apple.WebCore 0x000000010183f7da WebCore::ScriptController::executeScript(WebCore::ScriptSourceCode const&, WebCore::ShouldAllowXSS) + 142 (ScriptControllerBase.cpp:62) 19 com.apple.WebCore 0x0000000101a18b3a WebCore::XMLDocumentParser::notifyFinished(WebCore::CachedResource*) + 522 (XMLDocumentParser.cpp:344) 20 com.apple.WebCore 0x0000000100e98dc0 WebCore::CachedScript::checkNotify() + 86 (CachedScript.cpp:111) 21 com.apple.WebCore 0x0000000100e98e90 WebCore::CachedScript::data(WTF::PassRefPtr<WebCore::SharedBuffer>, bool) + 142 (CachedScript.cpp:103) 22 com.apple.WebCore 0x000000010161f119 WebCore::Loader::Host::didFinishLoading(WebCore::SubresourceLoader*) + 449 (loader.cpp:406) 23 com.apple.WebCore 0x00000001018c8ab7 WebCore::SubresourceLoader::didFinishLoading() + 159 (SubresourceLoader.cpp:196) 24 com.apple.WebCore 0x000000010181bbec WebCore::ResourceLoader::didFinishLoading(WebCore::ResourceHandle*) + 38 (ResourceLoader.cpp:444) 25 com.apple.WebCore 0x00000001018171e9 -[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:] + 270 (ResourceHandleMac.mm:860) 26 com.apple.Foundation 0x00007fff8334ab6c _NSURLConnectionDidFinishLoading + 113 27 com.apple.CFNetwork 0x00007fff8571806e URLConnectionClient::_clientDidFinishLoading(URLConnectionClient::ClientConnectionEventQueue*) + 174 28 com.apple.CFNetwork 0x00007fff8577d3e2 URLConnectionClient::ClientConnectionEventQueue::processAllEventsAndConsumePayload(XConnectionEventInfo<XClientEvent, XClientEventParams>*, long) + 254 29 com.apple.CFNetwork 0x00007fff8577d64e URLConnectionClient::ClientConnectionEventQueue::processAllEventsAndConsumePayload(XConnectionEventInfo<XClientEvent, XClientEventParams>*, long) + 874 30 com.apple.CFNetwork 0x00007fff8570479f URLConnectionClient::processEvents() + 121 31 com.apple.CFNetwork 0x00007fff8570457c MultiplexerSource::perform() + 160 32 com.apple.CoreFoundation 0x00007fff80137e91 __CFRunLoopDoSources0 + 1361 33 com.apple.CoreFoundation 0x00007fff80136089 __CFRunLoopRun + 873 34 com.apple.CoreFoundation 0x00007fff8013584f CFRunLoopRunSpecific + 575 35 com.apple.Foundation 0x00007fff83304a18 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 270 36 DumpRenderTree 0x0000000100010650 runTest(std::string const&) + 1795 (DumpRenderTree.mm:1276) 37 DumpRenderTree 0x0000000100010b3d runTestingServerLoop() + 145 (DumpRenderTree.mm:609) 38 DumpRenderTree 0x0000000100010f52 dumpRenderTree(int, char const**) + 309 (DumpRenderTree.mm:665) 39 DumpRenderTree 0x0000000100011174 main + 97 (DumpRenderTree.mm:707) 40 DumpRenderTree 0x0000000100002060 start + 52 248752 2 simon.fraser 2010-07-08 22:49:40 -0700 Asserts at ASSERT(!root->needsLayout()); after doing layout. I don't see this when running the test manually. 248880 3 zimmermann 2010-07-09 03:15:41 -0700 Found the problem: it's related to the SVG cloneNode fixes. The style attributes is being synchronized, when using cloneNode() while building the shadow tree. That causes attributeChanged() calls which in turn call SVGElementInstance::invalidateAllInstancesOfElement() marking the shadow tree as "needs to be recreated" while it's creating the tree. Going to fix soon. 248897 4 61030 zimmermann 2010-07-09 03:34:18 -0700 Created attachment 61030 Initial patch 248901 5 zimmermann 2010-07-09 03:51:53 -0700 Landed in r62931. Thanks Simon for the report, didn't notice that crash locally, only when running gdb on DRT. 61030 2010-07-09 03:34:18 -0700 2010-07-09 03:45:04 -0700 Initial patch FixUseCrash.diff text/plain 4666 zimmermann SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA2MjkyOCkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMjMgQEAKKzIwMTAtMDctMDkgIE5pa29sYXMgWmltbWVybWFubiAgPG56aW1tZXJt YW5uQHJpbS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg ICAgICAgc3ZnL2N1c3RvbS91c2UtaW5zdGFuY2VSb290LWV2ZW50LWJ1YmJsaW5nLnhodG1sIHRl c3QgY3Jhc2hlcworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/ aWQ9NDE5MzEKKworICAgICAgICBCZSBjYXJlZnVsIHRvIG5vdCBtdXRhdGUgKG1hcmtpbmcgaXQg Zm9yIHJlY3JlYXRpb24pIHRoZSBzaGFkb3cgdHJlZSwgd2hpbGUgYnVpbGRpbmcgaXQuCisgICAg ICAgIFRoZSByZWNlbnQgY2hhbmdlIHRoYXQgY2xvbmVOb2RlKCkgcHJvcGVybHkgc3luY2hyb25p emVzIHRoZSBzdHlsZS9TVkcgYXR0cmlidXRlcyBjYXVzZWQgdGhpcyBwcm9ibGVtLgorCisgICAg ICAgIEZpeGVzIGNyYXNoIHNlZW4gb24gdGhlIGJ1aWxkYm90cyBpbiBzdmcvY3VzdG9tL3VzZS1p bnN0YW5jZVJvb3QtZXZlbnQtYnViYmxpbmcueGh0bWwuCisKKyAgICAgICAgKiBzdmcvU1ZHVXNl RWxlbWVudC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpTVkdVc2VFbGVtZW50OjpTVkdVc2VFbGVt ZW50KToKKyAgICAgICAgKFdlYkNvcmU6OlNWR1VzZUVsZW1lbnQ6OnJlY2FsY1N0eWxlKToKKyAg ICAgICAgKFdlYkNvcmU6OlNWR1VzZUVsZW1lbnQ6OmJ1aWxkU2hhZG93QW5kSW5zdGFuY2VUcmVl KToKKyAgICAgICAgKFdlYkNvcmU6OlNWR1VzZUVsZW1lbnQ6OmludmFsaWRhdGVTaGFkb3dUcmVl KToKKyAgICAgICAgKiBzdmcvU1ZHVXNlRWxlbWVudC5oOgorICAgICAgICAoV2ViQ29yZTo6U1ZH VXNlRWxlbWVudDo6c2V0VXBkYXRlc0Jsb2NrZWQpOgorCiAyMDEwLTA3LTA5ICBBZGFtIEJhcnRo ICA8YWJhcnRoQHdlYmtpdC5vcmc+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgRXJpYyBTZWlkZWwu CkluZGV4OiBXZWJDb3JlL3N2Zy9TVkdVc2VFbGVtZW50LmNwcAo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJD b3JlL3N2Zy9TVkdVc2VFbGVtZW50LmNwcAkocmV2aXNpb24gNjI5MDIpCisrKyBXZWJDb3JlL3N2 Zy9TVkdVc2VFbGVtZW50LmNwcAkod29ya2luZyBjb3B5KQpAQCAtNjMsNiArNjMsNyBAQCBTVkdV c2VFbGVtZW50OjpTVkdVc2VFbGVtZW50KGNvbnN0IFF1YWxpCiAgICAgLCBtX3koTGVuZ3RoTW9k ZUhlaWdodCkKICAgICAsIG1fd2lkdGgoTGVuZ3RoTW9kZVdpZHRoKQogICAgICwgbV9oZWlnaHQo TGVuZ3RoTW9kZUhlaWdodCkKKyAgICAsIG1fdXBkYXRlc0Jsb2NrZWQoZmFsc2UpCiAgICAgLCBt X2lzUGVuZGluZ1Jlc291cmNlKGZhbHNlKQogICAgICwgbV9uZWVkc1NoYWRvd1RyZWVSZWNyZWF0 aW9uKGZhbHNlKQogewpAQCAtMzE0LDEzICszMTUsMTcgQEAgdm9pZCBTVkdVc2VFbGVtZW50Ojp1 cGRhdGVDb250YWluZXJPZmZzZQogdm9pZCBTVkdVc2VFbGVtZW50OjpyZWNhbGNTdHlsZShTdHls ZUNoYW5nZSBjaGFuZ2UpCiB7CiAgICAgLy8gRXZlbnR1YWxseSBtYXJrIHNoYWRvdyByb290IGVs ZW1lbnQgbmVlZGluZyBzdHlsZSByZWNhbGMKLSAgICBpZiAobmVlZHNTdHlsZVJlY2FsYygpICYm IG1fdGFyZ2V0RWxlbWVudEluc3RhbmNlKSB7CisgICAgaWYgKG5lZWRzU3R5bGVSZWNhbGMoKSAm JiBtX3RhcmdldEVsZW1lbnRJbnN0YW5jZSAmJiAhbV91cGRhdGVzQmxvY2tlZCkgewogICAgICAg ICBpZiAoU1ZHRWxlbWVudCogc2hhZG93Um9vdCA9IG1fdGFyZ2V0RWxlbWVudEluc3RhbmNlLT5z aGFkb3dUcmVlRWxlbWVudCgpKQogICAgICAgICAgICAgc2hhZG93Um9vdC0+c2V0TmVlZHNTdHls ZVJlY2FsYygpOwogICAgIH0KIAogICAgIFNWR1N0eWxlZFRyYW5zZm9ybWFibGVFbGVtZW50Ojpy ZWNhbGNTdHlsZShjaGFuZ2UpOwogCisgICAgLy8gQXNzdXJlIHRoYXQgdGhlIHNoYWRvdyB0cmVl IGhhcyBub3QgYmVlbiBtYXJrZWQgZm9yIHJlY3JlYXRpb24sIHdoaWxlIHdlJ3JlIGJ1aWxkaW5n IGl0LgorICAgIGlmIChtX3VwZGF0ZXNCbG9ja2VkKQorICAgICAgICBBU1NFUlQoIW1fbmVlZHNT aGFkb3dUcmVlUmVjcmVhdGlvbik7CisKICAgICBib29sIG5lZWRzU3R5bGVVcGRhdGUgPSAhbV9u ZWVkc1NoYWRvd1RyZWVSZWNyZWF0aW9uOwogICAgIGlmIChtX25lZWRzU2hhZG93VHJlZVJlY3Jl YXRpb24pIHsKICAgICAgICAgc3RhdGljX2Nhc3Q8UmVuZGVyU1ZHU2hhZG93VHJlZVJvb3RDb250 YWluZXIqPihyZW5kZXJlcigpKS0+bWFya1NoYWRvd1RyZWVGb3JSZWNyZWF0aW9uKCk7CkBAIC00 NDEsNiArNDQ2LDI2IEBAIHZvaWQgU1ZHVXNlRWxlbWVudDo6YnVpbGRQZW5kaW5nUmVzb3VyY2UK IAogdm9pZCBTVkdVc2VFbGVtZW50OjpidWlsZFNoYWRvd0FuZEluc3RhbmNlVHJlZShTVkdTaGFk b3dUcmVlUm9vdEVsZW1lbnQqIHNoYWRvd1Jvb3QpCiB7CisgICAgc3RydWN0IFNoYWRvd1RyZWVV cGRhdGVCbG9ja2VyIHsKKyAgICAgICAgU2hhZG93VHJlZVVwZGF0ZUJsb2NrZXIoU1ZHVXNlRWxl bWVudCogY3VycmVudFVzZUVsZW1lbnQpCisgICAgICAgICAgICA6IHVzZUVsZW1lbnQoY3VycmVu dFVzZUVsZW1lbnQpCisgICAgICAgIHsKKyAgICAgICAgICAgIHVzZUVsZW1lbnQtPnNldFVwZGF0 ZXNCbG9ja2VkKHRydWUpOworICAgICAgICB9CisKKyAgICAgICAgflNoYWRvd1RyZWVVcGRhdGVC bG9ja2VyKCkKKyAgICAgICAgeworICAgICAgICAgICAgdXNlRWxlbWVudC0+c2V0VXBkYXRlc0Js b2NrZWQoZmFsc2UpOworICAgICAgICB9CisKKyAgICAgICAgU1ZHVXNlRWxlbWVudCogdXNlRWxl bWVudDsKKyAgICB9OworCisgICAgLy8gV2hlbiBjbG9uaW5nIHRoZSB0YXJnZXQgbm9kZXMsIHRo ZXkgbWF5IGRlY2lkZSB0byBzeW5jaHJvbml6ZSBzdHlsZSBhbmQvb3IgYW5pbWF0ZWQgU1ZHIGF0 dHJpYnV0ZXMuCisgICAgLy8gVGhhdCBjYXVzZXMgY2FsbHMgdG8gU1ZHRWxlbWVudEluc3RhbmNl Ojp1cGRhdGVBbGxJbnN0YW5jZXNPZkVsZW1lbnQoKSwgd2hpY2ggbWFyayB0aGUgc2hhZG93IHRy ZWUgZm9yIHJlY3JlYXRpb24uCisgICAgLy8gU29sdXRpb246IGJsb2NrIGFueSB1cGRhdGVzIHRv IHRoZSBzaGFkb3cgdHJlZSB3aGlsZSB3ZSdyZSBidWlsZGluZyBpdC4KKyAgICBTaGFkb3dUcmVl VXBkYXRlQmxvY2tlciBibG9ja2VyKHRoaXMpOworCiAgICAgU3RyaW5nIGlkID0gU1ZHVVJJUmVm ZXJlbmNlOjpnZXRUYXJnZXQoaHJlZigpKTsKICAgICBFbGVtZW50KiB0YXJnZXRFbGVtZW50ID0g ZG9jdW1lbnQoKS0+Z2V0RWxlbWVudEJ5SWQoaWQpOwogICAgIGlmICghdGFyZ2V0RWxlbWVudCkg ewpAQCAtOTU5LDYgKzk4NCwxMCBAQCBTVkdFbGVtZW50SW5zdGFuY2UqIFNWR1VzZUVsZW1lbnQ6 Omluc3RhCiAKIHZvaWQgU1ZHVXNlRWxlbWVudDo6aW52YWxpZGF0ZVNoYWRvd1RyZWUoKQogewor ICAgIC8vIERvbid0IG11dGF0ZSB0aGUgc2hhZG93IHRyZWUgd2hpbGUgd2UncmUgYnVpbGRpbmcg aXQuCisgICAgaWYgKG1fdXBkYXRlc0Jsb2NrZWQpCisgICAgICAgIHJldHVybjsKKwogICAgIG1f bmVlZHNTaGFkb3dUcmVlUmVjcmVhdGlvbiA9IHRydWU7CiAgICAgc2V0TmVlZHNTdHlsZVJlY2Fs YygpOwogfQpJbmRleDogV2ViQ29yZS9zdmcvU1ZHVXNlRWxlbWVudC5oCj09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0t IFdlYkNvcmUvc3ZnL1NWR1VzZUVsZW1lbnQuaAkocmV2aXNpb24gNjI5MDIpCisrKyBXZWJDb3Jl L3N2Zy9TVkdVc2VFbGVtZW50LmgJKHdvcmtpbmcgY29weSkKQEAgLTY4LDYgKzY4LDggQEAgbmFt ZXNwYWNlIFdlYkNvcmUgewogICAgICAgICBTVkdFbGVtZW50SW5zdGFuY2UqIGluc3RhbmNlRm9y U2hhZG93VHJlZUVsZW1lbnQoTm9kZSogZWxlbWVudCkgY29uc3Q7CiAgICAgICAgIHZvaWQgaW52 YWxpZGF0ZVNoYWRvd1RyZWUoKTsKIAorICAgICAgICB2b2lkIHNldFVwZGF0ZXNCbG9ja2VkKGJv b2wgYmxvY2tlZCkgeyBtX3VwZGF0ZXNCbG9ja2VkID0gYmxvY2tlZDsgfQorCiAgICAgcHJpdmF0 ZToKICAgICAgICAgZnJpZW5kIGNsYXNzIFJlbmRlclNWR1NoYWRvd1RyZWVSb290Q29udGFpbmVy OwogICAgICAgICBib29sIGlzUGVuZGluZ1Jlc291cmNlKCkgY29uc3QgeyByZXR1cm4gbV9pc1Bl bmRpbmdSZXNvdXJjZTsgfQpAQCAtMTEwLDYgKzExMiw3IEBAIG5hbWVzcGFjZSBXZWJDb3JlIHsK ICAgICAgICAgdm9pZCB1cGRhdGVDb250YWluZXJPZmZzZXRzKCk7CiAgICAgICAgIHZvaWQgdXBk YXRlQ29udGFpbmVyU2l6ZXMoKTsKIAorICAgICAgICBib29sIG1fdXBkYXRlc0Jsb2NrZWQ7CiAg ICAgICAgIGJvb2wgbV9pc1BlbmRpbmdSZXNvdXJjZTsKICAgICAgICAgYm9vbCBtX25lZWRzU2hh ZG93VHJlZVJlY3JlYXRpb247CiAgICAgICAgIFN0cmluZyBtX3Jlc291cmNlSWQ7Cg==