44207 2010-08-18 15:32:35 -0700 Empty mfrac and empty munderover cause crashes 2010-08-18 17:27:06 -0700 1 1 1 Unclassified WebKit MathML 528+ (Nightly build) PC OS X 10.5 RESOLVED FIXED InRadar P2 Normal --- 1 bdakin webkit-unassigned bdakin oldest_to_newest 266420 0 bdakin 2010-08-18 15:32:35 -0700 I have test cases and a patch. Will post shortly. Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000 Crashed Thread: 0 Crashed Thread: 0 com.apple.WebCore 0x000000010153bdd0 WebCore::RenderMathMLUnderOver::baselinePosition(bool, bool) const + 192 1 com.apple.WebCore 0x0000000101005ccb WebCore::InlineFlowBox::computeLogicalBoxHeights(int&, int&, int&, int&, bool, WTF::HashMap<WebCore::InlineTextBox const*, std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow>, WTF::PtrHash<WebCore::InlineTextBox const*>, WTF::HashTraits<WebCore::InlineTextBox const*>, WTF::HashTraits<std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow> > >&) + 939 2 com.apple.WebCore 0x00000001015c7630 WebCore::RootInlineBox::verticallyAlignBoxes(int, WTF::HashMap<WebCore::InlineTextBox const*, std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow>, WTF::PtrHash<WebCore::InlineTextBox const*>, WTF::HashTraits<WebCore::InlineTextBox const*>, WTF::HashTraits<std::pair<WTF::Vector<WebCore::SimpleFontData const*, 0ul>, WebCore::GlyphOverflow> > >&) + 176 <rdar://problem/8325160> filefuzz: crash at WebCore::RenderMathMLUnderOver::baselinePosition(bool, bool) const+192 266422 1 64782 bdakin 2010-08-18 15:38:51 -0700 Created attachment 64782 Patch + tests 266473 2 bdakin 2010-08-18 17:27:06 -0700 Thanks Sam! http://trac.webkit.org/changeset/65646 64782 2010-08-18 15:38:51 -0700 2010-08-18 17:18:26 -0700 Patch + tests forReview.txt text/plain 6492 bdakin SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA2NTYzMykKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTggQEAKKzIwMTAtMDgtMTggIEJldGggRGFraW4gIDxiZGFraW5AYXBwbGUuY29t PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEZpeCBm b3IgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTQ0MjA3IEVtcHR5IG1m cmFjIAorICAgICAgICBhbmQgZW1wdHkgbXVuZGVyb3ZlciBjYXVzZSBjcmFzaGVzCisgICAgICAg LWFuZCBjb3JyZXNwb25kaW5nLQorICAgICAgICA8cmRhcjovL3Byb2JsZW0vODMyNTE2MD4KKwor ICAgICAgICBUaGlzIGlzIGp1c3QgYSAgbWF0dGVyIG9mIGFkZGluZyBudWxsIGNoZWNrcyBpbiB0 aGUgcmlnaHQgcGxhY2VzLgorICAgICAgICAqIG1hdGhtbC9SZW5kZXJNYXRoTUxGcmFjdGlvbi5j cHA6CisgICAgICAgIChXZWJDb3JlOjpSZW5kZXJNYXRoTUxGcmFjdGlvbjo6YmFzZWxpbmVQb3Np dGlvbik6CisgICAgICAgICogbWF0aG1sL1JlbmRlck1hdGhNTFVuZGVyT3Zlci5jcHA6CisgICAg ICAgIChXZWJDb3JlOjpSZW5kZXJNYXRoTUxVbmRlck92ZXI6OmJhc2VsaW5lUG9zaXRpb24pOgor CiAyMDEwLTA4LTE4ICBBZGFtIEJhcnRoICA8YWJhcnRoQHdlYmtpdC5vcmc+CiAKICAgICAgICAg UmV2aWV3ZWQgYnkgRGF2aWQgTGV2aW4uCkluZGV4OiBXZWJDb3JlL21hdGhtbC9SZW5kZXJNYXRo TUxGcmFjdGlvbi5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9tYXRobWwvUmVuZGVyTWF0aE1M RnJhY3Rpb24uY3BwCShyZXZpc2lvbiA2NTQ0MCkKKysrIFdlYkNvcmUvbWF0aG1sL1JlbmRlck1h dGhNTEZyYWN0aW9uLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMTc2LDcgKzE3Niw3IEBAIHZvaWQg UmVuZGVyTWF0aE1MRnJhY3Rpb246OnBhaW50KFBhaW50SW4KIAogaW50IFJlbmRlck1hdGhNTEZy YWN0aW9uOjpiYXNlbGluZVBvc2l0aW9uKGJvb2wgZmlyc3RMaW5lLCBib29sIGlzUm9vdExpbmVC b3gpIGNvbnN0CiB7Ci0gICAgaWYgKGZpcnN0Q2hpbGQoKS0+aXNSZW5kZXJNYXRoTUxCbG9jaygp KSB7CisgICAgaWYgKGZpcnN0Q2hpbGQoKSAmJiBmaXJzdENoaWxkKCktPmlzUmVuZGVyTWF0aE1M QmxvY2soKSkgewogICAgICAgICBSZW5kZXJNYXRoTUxCbG9jayogbnVtZXJhdG9yID0gdG9SZW5k ZXJNYXRoTUxCbG9jayhmaXJzdENoaWxkKCkpOwogICAgICAgICAvLyBGSVhNRTogdGhlIGJhc2Vs aW5lIHNob3VsZCBhZGp1c3Qgc28gdGhlIGZyYWN0aW9uIGxpbmUgYWxpZ25zCiAgICAgICAgIC8v IHJlbGF0aXZlIGNlcnRhaW4gb3BlcmF0b3JzIChlLmcuIGFsaWducyB3aXRoIHRoZSBob3Jpem9u dGFsCkluZGV4OiBXZWJDb3JlL21hdGhtbC9SZW5kZXJNYXRoTUxVbmRlck92ZXIuY3BwCj09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT0KLS0tIFdlYkNvcmUvbWF0aG1sL1JlbmRlck1hdGhNTFVuZGVyT3Zlci5jcHAJKHJldmlz aW9uIDY1NDQwKQorKysgV2ViQ29yZS9tYXRobWwvUmVuZGVyTWF0aE1MVW5kZXJPdmVyLmNwcAko d29ya2luZyBjb3B5KQpAQCAtMjM2LDM1ICsyMzYsMzUgQEAgdm9pZCBSZW5kZXJNYXRoTUxVbmRl ck92ZXI6OmxheW91dCgpIAogCiBpbnQgUmVuZGVyTWF0aE1MVW5kZXJPdmVyOjpiYXNlbGluZVBv c2l0aW9uKGJvb2wgZmlyc3RMaW5lLCBib29sIGlzUm9vdExpbmVCb3gpIGNvbnN0CiB7CisgICAg UmVuZGVyT2JqZWN0KiBjdXJyZW50ID0gZmlyc3RDaGlsZCgpOworICAgIGlmICghY3VycmVudCkK KyAgICAgICAgcmV0dXJuIFJlbmRlckJsb2NrOjpiYXNlbGluZVBvc2l0aW9uKGZpcnN0TGluZSwg aXNSb290TGluZUJveCk7CisKICAgICBpbnQgYmFzZWxpbmUgPSAwOwotICAgIFJlbmRlck9iamVj dCogY3VycmVudCA9IDA7CiAgICAgc3dpdGNoIChtX2tpbmQpIHsKICAgICBjYXNlIFVuZGVyT3Zl cjoKICAgICBjYXNlIE92ZXI6Ci0gICAgICAgIGN1cnJlbnQgPSBmaXJzdENoaWxkKCk7CiAgICAg ICAgIGJhc2VsaW5lICs9IGdldE9mZnNldEhlaWdodChjdXJyZW50KTsKICAgICAgICAgY3VycmVu dCA9IGN1cnJlbnQtPm5leHRTaWJsaW5nKCk7CiAgICAgICAgIGlmIChjdXJyZW50KSB7CiAgICAg ICAgICAgICAvLyBhY3R1YWwgYmFzZQogICAgICAgICAgICAgUmVuZGVyT2JqZWN0KiBiYXNlID0g Y3VycmVudC0+Zmlyc3RDaGlsZCgpOworICAgICAgICAgICAgaWYgKCFiYXNlKQorICAgICAgICAg ICAgICAgIGJyZWFrOwogICAgICAgICAgICAgYmFzZWxpbmUgKz0gYmFzZS0+YmFzZWxpbmVQb3Np dGlvbihmaXJzdExpbmUsIGlzUm9vdExpbmVCb3gpOwogICAgICAgICAgICAgLy8gYWRkZWQgdGhl IG5lZ2F0aXZlIHRvcCBtYXJnaW4KICAgICAgICAgICAgIGJhc2VsaW5lICs9IGN1cnJlbnQtPnN0 eWxlKCktPm1hcmdpblRvcCgpLnZhbHVlKCk7Ci0gICAgICAgICAgICAvLyBGSVhNRTogV2hlcmUg aXMgdGhlIGV4dHJhIDItM3B4IGFkanVzdGVkIGZvciB6b29tIGNvbWluZyBmcm9tPwotICAgICAg ICAgICAgZmxvYXQgem9vbUZhY3RvciA9IHN0eWxlKCktPmVmZmVjdGl2ZVpvb20oKTsKLSAgICAg ICAgICAgIGJhc2VsaW5lICs9IHN0YXRpY19jYXN0PGludD4oKHpvb21GYWN0b3IgPiAxLjI1ID8g MiA6IDMpICogem9vbUZhY3Rvcik7CiAgICAgICAgIH0KICAgICAgICAgYnJlYWs7CiAgICAgY2Fz ZSBVbmRlcjoKLSAgICAgICAgY3VycmVudCA9IGZpcnN0Q2hpbGQoKTsKLSAgICAgICAgaWYgKGN1 cnJlbnQpIHsKLSAgICAgICAgICAgIFJlbmRlck9iamVjdCogYmFzZSA9IGN1cnJlbnQtPmZpcnN0 Q2hpbGQoKTsKKyAgICAgICAgUmVuZGVyT2JqZWN0KiBiYXNlID0gY3VycmVudC0+Zmlyc3RDaGls ZCgpOworICAgICAgICBpZiAoYmFzZSkKICAgICAgICAgICAgIGJhc2VsaW5lICs9IGJhc2UtPmJh c2VsaW5lUG9zaXRpb24odHJ1ZSk7Ci0gICAgICAgICAgICAvLyBGSVhNRTogV2hlcmUgaXMgdGhl IGV4dHJhIDItM3B4IGFkanVzdGVkIGZvciB6b29tIGNvbWluZyBmcm9tPwotICAgICAgICAgICAg ZmxvYXQgem9vbUZhY3RvciA9IHN0eWxlKCktPmVmZmVjdGl2ZVpvb20oKTsKLSAgICAgICAgICAg IGJhc2VsaW5lICs9IHN0YXRpY19jYXN0PGludD4oKHpvb21GYWN0b3IgPiAxLjI1ID8gMiA6IDMp ICogem9vbUZhY3Rvcik7Ci0gICAgICAgIH0KICAgICB9CisKKyAgICAvLyBGSVhNRTogV2hlcmUg aXMgdGhlIGV4dHJhIDItM3B4IGFkanVzdGVkIGZvciB6b29tIGNvbWluZyBmcm9tPworICAgIGZs b2F0IHpvb21GYWN0b3IgPSBzdHlsZSgpLT5lZmZlY3RpdmVab29tKCk7CisgICAgYmFzZWxpbmUg Kz0gc3RhdGljX2Nhc3Q8aW50Pigoem9vbUZhY3RvciA+IDEuMjUgPyAyIDogMykgKiB6b29tRmFj dG9yKTsKICAgICByZXR1cm4gYmFzZWxpbmU7CiB9CiAKSW5kZXg6IExheW91dFRlc3RzL0NoYW5n ZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDY1NjM0 KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTYg QEAKKzIwMTAtMDgtMTggIEJldGggRGFraW4gIDxiZGFraW5AYXBwbGUuY29tPgorCisgICAgICAg IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRlc3RzIGZvciBodHRwczov L2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NDQyMDcgRW1wdHkgbWZyYWMgCisgICAg ICAgIGFuZCBlbXB0eSBtdW5kZXJvdmVyIGNhdXNlIGNyYXNoZXMKKyAgICAgICAtYW5kIGNvcnJl c3BvbmRpbmctCisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS84MzI1MTYwPgorICAgICAgICAqIG1h dGhtbC9FbXB0eU1GcmFjQ3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBtYXRo bWwvRW1wdHlNRnJhY0NyYXNoLnhodG1sOiBBZGRlZC4KKyAgICAgICAgKiBtYXRobWwvRW1wdHlN dW5kZXJPdmVyQ3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBtYXRobWwvRW1w dHlNdW5kZXJPdmVyQ3Jhc2gueGh0bWw6IEFkZGVkLgorCiAyMDEwLTA4LTE4ICBPamFuIFZhZmFp ICA8b2phbkBjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgVG9ueSBDaGFuZy4K SW5kZXg6IExheW91dFRlc3RzL21hdGhtbC9FbXB0eU1GcmFjQ3Jhc2gtZXhwZWN0ZWQudHh0Cj09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT0KLS0tIExheW91dFRlc3RzL21hdGhtbC9FbXB0eU1GcmFjQ3Jhc2gtZXhwZWN0ZWQu dHh0CShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvbWF0aG1sL0VtcHR5TUZyYWNDcmFzaC1l eHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEgQEAKK1RoaXMgdGVzdCBwYXNzZXMg aWYgaXQgZG9lcyBub3QgY3Jhc2guCkluZGV4OiBMYXlvdXRUZXN0cy9tYXRobWwvRW1wdHlNRnJh Y0NyYXNoLnhodG1sCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL21hdGhtbC9FbXB0eU1GcmFj Q3Jhc2gueGh0bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9tYXRobWwvRW1wdHlNRnJh Y0NyYXNoLnhodG1sCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDE3IEBACis8P3htbCB2ZXJzaW9u PSIxLjAiIGVuY29kaW5nPSJVVEYtOCI/PgorPGh0bWwgeG1sbnM9Imh0dHA6Ly93d3cudzMub3Jn LzE5OTkveGh0bWwiIHhtbG5zOm09Imh0dHA6Ly93d3cudzMub3JnLzE5OTgvTWF0aC9NYXRoTUwi IHhtbDpsYW5nPSJlbiI+Cis8aGVhZD4KKzxzY3JpcHQ+CisgICAgaWYgKHdpbmRvdy5sYXlvdXRU ZXN0Q29udHJvbGxlcikKKyAgICAgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4dCgp OworPC9zY3JpcHQ+Cis8L2hlYWQ+Cis8Ym9keT4KKyAgICA8bWF0aCB4bWxucz0iaHR0cDovL3d3 dy53My5vcmcvMTk5OC9NYXRoL01hdGhNTCI+IAorICAgICAgICA8bXRleHQ+VGhpcyB0ZXN0IHBh c3NlcyBpZiBpdCBkb2VzIG5vdCBjcmFzaC48L210ZXh0PgorICAgICAgICA8bXJvdz4gCisgICAg ICAgICAgICA8bWZyYWM+PC9tZnJhYz4gCisgICAgICAgIDwvbXJvdz4gCisgICAgPC9tYXRoPgor PC9ib2R5PgorPC9odG1sPgpJbmRleDogTGF5b3V0VGVzdHMvbWF0aG1sL0VtcHR5TXVuZGVyT3Zl ckNyYXNoLWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9tYXRobWwvRW1w dHlNdW5kZXJPdmVyQ3Jhc2gtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVz dHMvbWF0aG1sL0VtcHR5TXVuZGVyT3ZlckNyYXNoLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkK QEAgLTAsMCArMSBAQAorVGhpcyB0ZXN0IHBhc3NlcyBpZiBpdCBkb2VzIG5vdCBjcmFzaC4KSW5k ZXg6IExheW91dFRlc3RzL21hdGhtbC9FbXB0eU11bmRlck92ZXJDcmFzaC54aHRtbAo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09Ci0tLSBMYXlvdXRUZXN0cy9tYXRobWwvRW1wdHlNdW5kZXJPdmVyQ3Jhc2gueGh0bWwJKHJl dmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9tYXRobWwvRW1wdHlNdW5kZXJPdmVyQ3Jhc2gueGh0 bWwJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMTcgQEAKKzw/eG1sIHZlcnNpb249IjEuMCIgZW5j b2Rpbmc9IlVURi04Ij8+Cis8aHRtbCB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMTk5OS94aHRt bCIgeG1sbnM6bT0iaHR0cDovL3d3dy53My5vcmcvMTk5OC9NYXRoL01hdGhNTCIgeG1sOmxhbmc9 ImVuIj4KKzxoZWFkPgorPHNjcmlwdD4KKyAgICBpZiAod2luZG93LmxheW91dFRlc3RDb250cm9s bGVyKQorICAgICAgICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7Cis8L3Njcmlw dD4KKzwvaGVhZD4KKzxib2R5PgorPG1hdGggeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzE5OTgv TWF0aC9NYXRoTUwiPiAKKyAgICA8bXRleHQ+VGhpcyB0ZXN0IHBhc3NlcyBpZiBpdCBkb2VzIG5v dCBjcmFzaC48L210ZXh0PiAKKyAgICA8bXJvdz4gCisgICAgICAgIDxtdW5kZXJvdmVyPjwvbXVu ZGVyb3Zlcj4gCisgICAgPC9tcm93PiAKKzwvbWF0aD4KKzwvYm9keT4KKzwvaHRtbD4K