49316 2010-11-10 04:10:36 -0800 chrome.dll!WebCore::Node::createRendererIfNeeded ReadAV@NULL (7079875ef32458c5c891a311715b683f) 2011-06-13 13:16:36 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) PC Windows Vista RESOLVED FIXED http://code.google.com/p/chromium/issues/detail?id=62659 P1 Normal --- 1 skylined jchaffraix ap eric.carlson eric jchaffraix webkit.review.bot zimmermann oldest_to_newest 307293 0 73485 skylined 2010-11-10 04:10:36 -0800 Created attachment 73485 Repro Repro.html: <svg><use><style>:first-letter{margin-right:auto}<i><style> id: chrome.dll!WebCore::Node::createRendererIfNeeded ReadAV@NULL (7079875ef32458c5c891a311715b683f) description: Attempt to read from unallocated NULL pointer+0x20 in chrome.dll!WebCore::Node::createRendererIfNeeded application: Chromium 9.0.571.0 stack: chrome.dll!WebCore::Node::createRendererIfNeeded chrome.dll!WebCore::Element::attach chrome.dll!WebCore::HTMLMediaElement::attach chrome.dll!WebCore::Element::recalcStyle chrome.dll!WebCore::SVGUseElement::recalcStyle chrome.dll!WebCore::Element::recalcStyle chrome.dll!WebCore::Element::recalcStyle chrome.dll!WebCore::Element::recalcStyle chrome.dll!WebCore::Document::recalcStyle chrome.dll!WebCore::Document::styleSelectorChanged chrome.dll!WebCore::Document::removePendingSheet chrome.dll!WebCore::StyleElement::sheetLoaded chrome.dll!WebCore::HTMLStyleElement::sheetLoaded chrome.dll!WebCore::CSSStyleSheet::checkLoaded chrome.dll!WebCore::StyleElement::createSheet chrome.dll!WebCore::StyleElement::process chrome.dll!WebCore::StyleElement::finishParsingChildren chrome.dll!WebCore::HTMLStyleElement::finishParsingChildren chrome.dll!WebCore::HTMLElementStack::popCommon chrome.dll!WebCore::HTMLTreeBuilder::processEndOfFile chrome.dll!WebCore::HTMLTreeBuilder::constructTreeFromAtomicToken chrome.dll!WebCore::HTMLTreeBuilder::constructTreeFromToken chrome.dll!WebCore::HTMLDocumentParser::pumpTokenizer chrome.dll!WebCore::HTMLDocumentParser::prepareToStopParsing chrome.dll!WebCore::DocumentWriter::endIfNotLoadingMainResource chrome.dll!WebCore::FrameLoader::finishedLoading chrome.dll!WebCore::MainResourceLoader::didFinishLoading chrome.dll!WebCore::ResourceLoader::didFinishLoading chrome.dll!WebCore::ResourceHandleInternal::didFinishLoading ... 307382 1 eric 2010-11-10 09:27:41 -0800 Guessing from the stack trace, HTMLMediaElement::attach is probably not handling a null pointer like it should. 307455 2 eric.carlson 2010-11-10 11:25:03 -0800 Node::createRendererIfNeeded asserts in a debug build because parentNode() return NULL. 307456 3 eric.carlson 2010-11-10 11:33:05 -0800 And HTMLMediaElement::attach isn't called: WebCore::Node::createRendererIfNeeded at Node.cpp:1327 WebCore::Element::attach at Element.cpp:882 WebCore::SVGStyledElement::attach at SVGStyledElement.cpp:266 WebCore::Element::recalcStyle at Element.cpp:973 WebCore::RenderSVGShadowTreeRootContainer::updateStyle at RenderSVGShadowTreeRootContainer.cpp:46 WebCore::SVGUseElement::recalcStyle at SVGUseElement.cpp:346 WebCore::Element::recalcStyle at Element.cpp:1036 WebCore::Element::recalcStyle at Element.cpp:1036 WebCore::Element::recalcStyle at Element.cpp:1036 WebCore::Document::recalcStyle at Document.cpp:1511 WebCore::Document::styleSelectorChanged at Document.cpp:2841 WebCore::Document::removePendingSheet at Document.cpp:2799 WebCore::StyleElement::sheetLoaded at StyleElement.cpp:168 WebCore::HTMLStyleElement::sheetLoaded at HTMLStyleElement.h:53 WebCore::CSSStyleSheet::checkLoaded at CSSStyleSheet.cpp:214 WebCore::StyleElement::createSheet at StyleElement.cpp:152 WebCore::StyleElement::process at StyleElement.cpp:121 WebCore::StyleElement::finishParsingChildren at StyleElement.cpp:90 WebCore::HTMLStyleElement::finishParsingChildren at HTMLStyleElement.cpp:61 WebCore::HTMLElementStack::popCommon at HTMLElementStack.cpp:538 WebCore::HTMLElementStack::pop at HTMLElementStack.cpp:209 WebCore::HTMLTreeBuilder::processEndOfFile at HTMLTreeBuilder.cpp:2627 WebCore::HTMLTreeBuilder::processToken at HTMLTreeBuilder.cpp:477 WebCore::HTMLTreeBuilder::constructTreeFromAtomicToken at HTMLTreeBuilder.cpp:446 WebCore::HTMLTreeBuilder::constructTreeFromToken at HTMLTreeBuilder.cpp:441 WebCore::HTMLDocumentParser::pumpTokenizer at HTMLDocumentParser.cpp:223 WebCore::HTMLDocumentParser::pumpTokenizerIfPossible at HTMLDocumentParser.cpp:169 WebCore::HTMLDocumentParser::prepareToStopParsing at HTMLDocumentParser.cpp:139 WebCore::HTMLDocumentParser::attemptToEnd at HTMLDocumentParser.cpp:344 WebCore::HTMLDocumentParser::finish at HTMLDocumentParser.cpp:372 WebCore::Document::finishParsing at Document.cpp:2191 WebCore::DocumentWriter::endIfNotLoadingMainResource at DocumentWriter.cpp:221 WebCore::DocumentWriter::end at DocumentWriter.cpp:206 WebCore::DocumentLoader::finishedLoading at DocumentLoader.cpp:276 WebCore::FrameLoader::finishedLoading at FrameLoader.cpp:2165 WebCore::MainResourceLoader::didFinishLoading at MainResourceLoader.cpp:456 WebCore::ResourceLoader::didFinishLoading at ResourceLoader.cpp:421 307562 4 ap 2010-11-10 14:28:14 -0800 It would be very interesting if HTMLMediaElement::attach() were actually called, given that there are no media elements in the test case. SkyLined, can you double-check in Chrome? 307580 5 skylined 2010-11-10 14:50:14 -0800 (In reply to comment #4) > It would be very interesting if HTMLMediaElement::attach() were actually called, given that there are no media elements in the test case. SkyLined, can you double-check in Chrome? I checked and I am now seeing the same stack trace as Eric and a different id with the same repro...? Maybe I screwed up somewhere... very odd. I'll let it run a zillion times overnight to see if it can happen again. id: chrome.dll!WebCore::Node::createRendererIfNeeded ReadAV@NULL (e3c5b4a57108b2b92aca035978f4519f) description: Attempt to read from unallocated NULL pointer+0x20 in chrome.dll!WebCore::Node::createRendererIfNeeded application: Chromium 9.0.579.0 stack: chrome.dll!WebCore::Node::createRendererIfNeeded chrome.dll!WebCore::Element::attach chrome.dll!WebCore::SVGStyledElement::attach chrome.dll!WebCore::Element::recalcStyle chrome.dll!WebCore::SVGUseElement::recalcStyle chrome.dll!WebCore::Element::recalcStyle chrome.dll!WebCore::Element::recalcStyle chrome.dll!WebCore::Element::recalcStyle chrome.dll!WebCore::Document::recalcStyle chrome.dll!WebCore::Document::styleSelectorChanged chrome.dll!WebCore::Document::removePendingSheet chrome.dll!WebCore::StyleElement::sheetLoaded chrome.dll!WebCore::SVGStyleElement::sheetLoaded chrome.dll!WebCore::CSSStyleSheet::checkLoaded chrome.dll!WebCore::StyleElement::createSheet chrome.dll!WebCore::StyleElement::process chrome.dll!WebCore::StyleElement::finishParsingChildren chrome.dll!WebCore::HTMLStyleElement::finishParsingChildren chrome.dll!WebCore::HTMLElementStack::popCommon chrome.dll!WebCore::HTMLTreeBuilder::processEndOfFile chrome.dll!WebCore::HTMLTreeBuilder::constructTreeFromAtomicToken chrome.dll!WebCore::HTMLTreeBuilder::constructTreeFromToken chrome.dll!WebCore::HTMLDocumentParser::pumpTokenizer chrome.dll!WebCore::HTMLDocumentParser::prepareToStopParsing chrome.dll!WebCore::DocumentWriter::endIfNotLoadingMainResource chrome.dll!WebCore::FrameLoader::finishedLoading chrome.dll!WebCore::MainResourceLoader::didFinishLoading chrome.dll!WebCore::ResourceLoader::didFinishLoading chrome.dll!WebCore::ResourceHandleInternal::didFinishLoading chrome.dll!webkit_glue::WebURLLoaderImpl::Context::OnCompletedRequest chrome.dll!ResourceDispatcher::OnRequestComplete chrome.dll!IPC::MessageWithTuple<...> chrome.dll!ResourceDispatcher::DispatchMessageW chrome.dll!ResourceDispatcher::OnMessageReceived chrome.dll!ChildThread::OnMessageReceived chrome.dll!RunnableMethod<...>::Run chrome.dll!MessageLoop::RunTask chrome.dll!MessageLoop::DoWork chrome.dll!base::MessagePumpDefault::Run chrome.dll!MessageLoop::RunInternal chrome.dll!MessageLoop::Run chrome.dll!RendererMain chrome.dll!ChromeMain 307581 6 skylined 2010-11-10 14:52:20 -0800 (In reply to comment #5) Just noticed I updated my Chrome, so it may be there was a bad build or a bug that was fixed that changed this. Anyway, I will try to see if I can get the "HTMLMediaElement::attach" crash again. Please assume that that was a fluke unless I report back that it can really happen. 307755 7 skylined 2010-11-11 00:12:00 -0800 (In reply to comment #6) > Anyway, I will try to see if I can get the "HTMLMediaElement::attach" crash again. I ran it 146 times overnight and got only crashes without "HTMLMediaElement::attach" on the stack. 309261 8 skylined 2010-11-15 06:49:19 -0800 Another repro for the same issue: <script> document.write('<svg><use style="float:right;"><style>'); </script> 419658 9 96972 jchaffraix 2011-06-13 10:47:41 -0700 Created attachment 96972 Trivial fix: land the test case for the solved bug 419794 10 96972 webkit.review.bot 2011-06-13 13:16:32 -0700 Comment on attachment 96972 Trivial fix: land the test case for the solved bug Clearing flags on attachment: 96972 Committed r88678: <http://trac.webkit.org/changeset/88678> 419795 11 webkit.review.bot 2011-06-13 13:16:36 -0700 All reviewed patches have been landed. Closing bug. 73485 2010-11-10 04:10:36 -0800 2010-11-10 04:10:36 -0800 Repro repro.html text/html 59 skylined PHN2Zz48dXNlPjxzdHlsZT46Zmlyc3QtbGV0dGVye21hcmdpbi1yaWdodDphdXRvfTxpPjxzdHls ZT4= 96972 2011-06-13 10:47:41 -0700 2011-06-13 13:16:31 -0700 Trivial fix: land the test case for the solved bug bug-49316-20110613104739.patch text/plain 3116 jchaffraix U3VidmVyc2lvbiBSZXZpc2lvbjogODg2NDMKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5n ZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCA0Njk5YTE2M2Y5OTY3MjY1OTkxNGEy ZTVjYTYxYWNmNmIwZjk0NWE3Li5jNGY4NDdkNGVmYzMwZmIyYjY2YmYyMDU2MjdlMDJiNDYwNTc1 N2U4IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMv Q2hhbmdlTG9nCkBAIC0xLDMgKzEsMTkgQEAKKzIwMTEtMDYtMTMgIEp1bGllbiBDaGFmZnJhaXgg IDxqY2hhZmZyYWl4QHdlYmtpdC5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKKyAgICAgICAgY2hyb21lLmRsbCFXZWJDb3JlOjpOb2RlOjpjcmVhdGVSZW5kZXJl cklmTmVlZGVkIFJlYWRBVkBOVUxMICg3MDc5ODc1ZWYzMjQ1OGM1Yzg5MWEzMTE3MTViNjgzZikK KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTQ5MzE2CisK KyAgICAgICAgVGhlIGJ1ZyBnb3QgZml4ZWQsIHRodXMganVzdCBsYW5kaW5nIHRoZSB0ZXN0IGNh c2UuIEluY2x1ZGluZyBhbm90aGVyIHRlc3QgY2FzZSBmcm9tCisgICAgICAgIGh0dHA6Ly9jb2Rl Lmdvb2dsZS5jb20vcC9jaHJvbWl1bS9pc3N1ZXMvZGV0YWlsP2lkPTYxNTYyCisgICAgICAgIHdo aWNoIHNob3VsZCBoYXZlIHRoZSBzYW1lIHJvb3QgY2F1c2UuCisKKyAgICAgICAgKiBmYXN0L2h0 bWwvY3Jhc2gtc3R5bGUtZmlyc3QtbGV0dGVyLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAg ICogZmFzdC9odG1sL2NyYXNoLXN0eWxlLWZpcnN0LWxldHRlci5odG1sOiBBZGRlZC4KKyAgICAg ICAgKiBzdmcvY3VzdG9tL3N2Zy11c2Utc3R5bGUtZmxvYXQtY3Jhc2gtZXhwZWN0ZWQudHh0OiBB ZGRlZC4KKyAgICAgICAgKiBzdmcvY3VzdG9tL3N2Zy11c2Utc3R5bGUtZmxvYXQtY3Jhc2guc3Zn OiBBZGRlZC4KKwogMjAxMS0wNi0xMyAgVml0YWx5IFJlcGVzaGtvICA8dml0YWx5ckBjaHJvbWl1 bS5vcmc+CiAKIAlVbnJldmlld2VkLgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9odG1s L2NyYXNoLXN0eWxlLWZpcnN0LWxldHRlci1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9mYXN0 L2h0bWwvY3Jhc2gtc3R5bGUtZmlyc3QtbGV0dGVyLWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2Rl IDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi5i NTFiYjM2MzJiM2Q3NWQ1ODIyYTNlMmM3NGZlYjdiNTk2NzMxOWE2Ci0tLSAvZGV2L251bGwKKysr IGIvTGF5b3V0VGVzdHMvZmFzdC9odG1sL2NyYXNoLXN0eWxlLWZpcnN0LWxldHRlci1leHBlY3Rl ZC50eHQKQEAgLTAsMCArMSwzIEBACitUZXN0IGZvciBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9z aG93X2J1Zy5jZ2k/aWQ9NDkzMTY6IFRoZSB0ZXN0IFBBU1NFRCBpZiBpdCBkaWQgbm90IGNyYXNo LgorCisKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvaHRtbC9jcmFzaC1zdHlsZS1maXJz dC1sZXR0ZXIuaHRtbCBiL0xheW91dFRlc3RzL2Zhc3QvaHRtbC9jcmFzaC1zdHlsZS1maXJzdC1s ZXR0ZXIuaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwLi5mZGU5ODYwNDk3NzNmZmQ1NjRlNTRjZTQxNTIzM2RjYTJj MTEwMzljCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9odG1sL2NyYXNoLXN0 eWxlLWZpcnN0LWxldHRlci5odG1sCkBAIC0wLDAgKzEgQEAKKzxzdmc+PHA+VGVzdCBmb3IgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTQ5MzE2OiBUaGUgdGVzdCBQQVNT RUQgaWYgaXQgZGlkIG5vdCBjcmFzaC48L3A+PHNjcmlwdD5pZiAod2luZG93LmxheW91dFRlc3RD b250cm9sbGVyKSBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7PC9zY3JpcHQ+PHVz ZT48c3R5bGU+OmZpcnN0LWxldHRlcnttYXJnaW4tcmlnaHQ6YXV0b308aT48c3R5bGU+CmRpZmYg LS1naXQgYS9MYXlvdXRUZXN0cy9zdmcvY3VzdG9tL3N2Zy11c2Utc3R5bGUtZmxvYXQtY3Jhc2gt ZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvc3ZnL2N1c3RvbS9zdmctdXNlLXN0eWxlLWZsb2F0 LWNyYXNoLWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi5jYzI2ZDRkNTJiZWJkMTMyMGZjNTZjZmNk MWEzZDhjYzYxODU5NTI5Ci0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvc3ZnL2N1c3Rv bS9zdmctdXNlLXN0eWxlLWZsb2F0LWNyYXNoLWV4cGVjdGVkLnR4dApAQCAtMCwwICsxLDIgQEAK K1Rlc3QgZm9yIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD00OTMxNgor UEFTU0VEIChkaWQgbm90IGNyYXNoKQpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvc3ZnL2N1c3Rv bS9zdmctdXNlLXN0eWxlLWZsb2F0LWNyYXNoLnN2ZyBiL0xheW91dFRlc3RzL3N2Zy9jdXN0b20v c3ZnLXVzZS1zdHlsZS1mbG9hdC1jcmFzaC5zdmcKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXgg MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uNjYzZTQxODQ4NGNiOWY5 ODlhYzM2MDkzZjU4NjY5MWQxMTJkMmZlMAotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3Rz L3N2Zy9jdXN0b20vc3ZnLXVzZS1zdHlsZS1mbG9hdC1jcmFzaC5zdmcKQEAgLTAsMCArMSw5IEBA Cis8c3ZnIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+IAorPHVzZSBzdHlsZT0i ZmxvYXQ6bGVmdCIvPiAgCis8dGV4dCB4PSIxMCIgeT0iMzAiPlRlc3QgZm9yIGh0dHBzOi8vYnVn cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD00OTMxNjwvdGV4dD4KKzx0ZXh0IGlkPSJjb25z b2xlIiB4PSIxMCIgeT0iNjAiPlBBU1NFRCAoZGlkIG5vdCBjcmFzaCk8L3RleHQ+Cis8c2NyaXB0 PgoraWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikKKyAgICBsYXlvdXRUZXN0Q29udHJv bGxlci5kdW1wQXNUZXh0KCk7Cis8L3NjcmlwdD4KKzwvc3ZnPgo=