51647 2010-12-27 07:47:38 -0800 chrome.dll!WebCore::RenderBox::paintBoxDecorationsWithSize ReadAV@NULL (214b527fa4dab86d8d344b0220263689) 2011-12-16 05:57:21 -0800 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) PC Windows Vista RESOLVED DUPLICATE 64284 P1 Normal --- 1 skylined webkit-unassigned abarth dglazkov eae eric tonyg webkit.review.bot oldest_to_newest 327042 0 77508 skylined 2010-12-27 07:47:38 -0800 Created attachment 77508 Repro http://code.google.com/p/chromium/issues/detail?id=68094 Repro: <script> function go() { oHTMLElement = document.documentElement.firstChild; document.open(); document.appendChild(oHTMLElement) document.writeln("<object>" + "<style>" + "@page {border-right: thick;}" + "* {border-right: medium dashed;}" + "</style>") location.reload(); } </script> <body onload="go()"> id: chrome.dll!WebCore::RenderBox::paintBoxDecorationsWithSize ReadAV@NULL (214b527fa4dab86d8d344b0220263689) description: Attempt to read from unallocated NULL pointer+0x4 in chrome.dll!WebCore::RenderBox::paintBoxDecorationsWithSize application: Chromium 10.0.623.0 stack: chrome.dll!WebCore::RenderBox::paintBoxDecorationsWithSize chrome.dll!WebCore::RenderBox::paintBoxDecorations chrome.dll!WebCore::RenderBlock::paintObject chrome.dll!WebCore::RenderBlock::paint chrome.dll!WebCore::RenderBlock::paintChildren chrome.dll!WebCore::RenderBlock::paintContents chrome.dll!WebCore::RenderBlock::paintObject chrome.dll!WebCore::RenderBlock::paint chrome.dll!WebCore::RenderBlock::paintChildren chrome.dll!WebCore::RenderBlock::paintContents chrome.dll!WebCore::RenderBlock::paintObject chrome.dll!WebCore::RenderLayer::paintLayer chrome.dll!WebCore::RenderLayer::paint chrome.dll!WebCore::FrameView::paintContents chrome.dll!WebCore::ScrollView::paint chrome.dll!WebKit::WebFrameImpl::paintWithContext chrome.dll!WebKit::WebFrameImpl::paint chrome.dll!RenderWidget::PaintRect chrome.dll!RenderWidget::DoDeferredUpdate chrome.dll!RenderWidget::CallDoDeferredUpdate chrome.dll!MessageLoop::RunTask chrome.dll!MessageLoop::DoWork chrome.dll!base::MessagePumpDefault::Run chrome.dll!MessageLoop::RunInternal ... 327071 1 eric 2010-12-27 10:06:41 -0800 We'll have to catch this in the debugger to find out which line is actually crashing. 327224 2 skylined 2010-12-28 06:58:25 -0800 http://trac.webkit.org/browser/trunk/WebCore/rendering/RenderBox.cpp#L814 797 void RenderBox::paintBoxDecorationsWithSize(PaintInfo& paintInfo, int tx, int ty, int width, int height) 798 { 799 // border-fit can adjust where we paint our border and background. If set, we snugly fit our line box descendants. (The iChat 800 // balloon layout is an example of this). 801 borderFitAdjust(tx, width); 802 803 // FIXME: Should eventually give the theme control over whether the box shadow should paint, since controls could have 804 // custom shadows of their own. 805 paintBoxShadow(paintInfo.context, tx, ty, width, height, style(), Normal); 806 807 // If we have a native theme appearance, paint that before painting our background. 808 // The theme will tell us whether or not we should also paint the CSS background. 809 bool themePainted = style()->hasAppearance() && !theme()->paint(this, paintInfo, IntRect(tx, ty, width, height)); 810 if (!themePainted) { 811 // The <body> only paints its background if the root element has defined a background 812 // independent of the body. Go through the DOM to get to the root element's render object, 813 // since the root could be inline and wrapped in an anonymous block. 814 if (!isBody() || document()->documentElement()->renderer()->hasBackground()) 815 paintFillLayers(paintInfo, style()->visitedDependentColor(CSSPropertyBackgroundColor), style()->backgroundLayers(), tx, ty, width, height); 816 if (style()->hasAppearance()) 817 theme()->paintDecorations(this, paintInfo, IntRect(tx, ty, width, height)); 818 } 819 paintBoxShadow(paintInfo.context, tx, ty, width, height, style(), Inset); 820 821 // The theme will tell us whether or not we should also paint the CSS border. 822 if ((!style()->hasAppearance() || (!themePainted && theme()->paintBorderOnly(this, paintInfo, IntRect(tx, ty, width, height)))) && style()->hasBorder()) 823 paintBorder(paintInfo.context, tx, ty, width, height, style()); 824 } "document()->documentElement()->renderer()" returns NULL, so "(NULL)->hasBackground()" causes a NULL deref. chrome_639d0000!WebCore::RenderBox::paintBoxDecorationsWithSize+0x9a [c:\b\build\slave\win\build\src\third_party\webkit\webcore\rendering\renderbox.cpp @ 814]: 6431292a 3400 xor al,0 6431292c e8af6ff8ff call chrome_639d0000!WebCore::RenderObject::isBody (642998e0) 64312931 84c0 test al,al 64312933 7431 je chrome_639d0000!WebCore::RenderBox::paintBoxDecorationsWithSize+0xd6 (64312966) 64312935 8b4e08 mov ecx,dword ptr [esi+8] 64312938 8b4914 mov ecx,dword ptr [ecx+14h] 6431293b 83b98c02000000 cmp dword ptr [ecx+28Ch],0 64312942 894c242c mov dword ptr [esp+2Ch],ecx 64312946 7509 jne chrome_639d0000!WebCore::RenderBox::paintBoxDecorationsWithSize+0xc1 (64312951) 64312948 e833acf3ff call chrome_639d0000!WebCore::Document::cacheDocumentElement (6424d580) 6431294d 8b4c242c mov ecx,dword ptr [esp+2Ch] 64312951 8b918c020000 mov edx,dword ptr [ecx+28Ch] 64312957 8b4220 mov eax,dword ptr [edx+20h] chrome_639d0000!WebCore::RenderBox::paintBoxDecorationsWithSize+0xca [c:\b\build\slave\win\build\src\third_party\webkit\webcore\rendering\renderbox.cpp @ 814]: eax=00000000 ebx=0037e9c8 ecx=0187e900 edx=0412fec0 esi=00ab82f8 edi=00000299 eip=6431295a esp=0037e8f4 ebp=00000008 6431295a 8b4804 mov ecx,dword ptr [eax+4] 6431295d e80e8efbff call chrome_639d0000!WebCore::RenderStyle::hasBackground (642cb770) 64312962 84c0 test al,al 64312964 7432 je chrome_639d0000!WebCore::RenderBox::paintBoxDecorationsWithSize+0x108 (64312998) 64312966 8b542430 mov edx,dword ptr [esp+30h] 6431296a 8b4e04 mov ecx,dword ptr [esi+4] 6431296d 8b4114 mov eax,dword ptr [ecx+14h] 64312970 6a00 push 0 64312972 6a02 push 2 64312974 57 push edi 64312975 52 push edx 64312976 8b542438 mov edx,dword ptr [esp+38h] 6431297a 55 push ebp 6431297b 52 push edx 6431297c 83c004 add eax,4 6431297f 50 push eax 64312980 68fb030000 push 3FBh 64312985 8d442430 lea eax,[esp+30h] 64312989 50 push eax 331043 3 78279 eae 2011-01-07 15:08:15 -0800 Created attachment 78279 Patch I tried to make do without adding a new field but couldn't find any way to detect the state properly using existing data. 331063 4 webkit.review.bot 2011-01-07 15:39:17 -0800 Attachment 78279 did not build on chromium: Build output: http://queues.webkit.org/results/7404036 331069 5 78279 abarth 2011-01-07 15:42:03 -0800 Comment on attachment 78279 Patch Hum... This doesn't seem right. Why doesn't the spec need to track this bool? 331089 6 abarth 2011-01-07 16:36:06 -0800 Generally, we should be robust to document.writing and adding elements via the DOM in arbitrary orders. I don't quite understand why it's crashing. 331090 7 eae 2011-01-07 16:37:33 -0800 Document::write assumes the document is open for writing if the parser has an insert point. Appending an element after calling document.open does not reset the insert point thus the assumption is incorrect when the document.write call is expected. Another way around this would possibly be to reset the insert point (either directly or by detaching the parser) when append is called. 331104 8 abarth 2011-01-07 17:06:36 -0800 > Document::write assumes the document is open for writing if the parser has an insert point. That should be a correct assumption. > Appending an element after calling document.open does not reset the insert point thus the assumption is incorrect when the document.write call is expected. I'm not sure I understand. Why should appending an element to the DOM affect the insertion point? > Another way around this would possibly be to reset the insert point (either directly or by detaching the parser) when append is called. The insertion point has to do with the front-end to the HTML parser. The DOM is the backend output of the parser. The parser should know how to operate on a DOM that's been manipulated by means other than the parser... 331105 9 eae 2011-01-07 17:12:57 -0800 You are right, the proposed change clearly isn't the right way to do this. I'll rethink the approach, thanks for the pointers. 331863 10 eae 2011-01-10 13:01:48 -0800 The problem seems to be that document parser is unaware of the html element being appended and as such it's still in the InitialMode InsertionMode. It then calls Document::setCompatibilityMode which fails the ASSERT(!documentElement()) assertion as it already has a document element. IE and Mozilla throws a HIERARCHY_REQUEST_ERR exception for the appendChild call and IE throws a invalid argument. Perhaps that's how we should handle it too? 522716 11 skylined 2011-12-16 05:57:21 -0800 This has been fixed in the duplicate bug. *** This bug has been marked as a duplicate of bug 64284 *** 77508 2010-12-27 07:47:38 -0800 2010-12-27 07:47:38 -0800 Repro repro.html text/html 347 skylined PHNjcmlwdD4KICBmdW5jdGlvbiBnbygpIHsKICAgIG9IVE1MRWxlbWVudCA9IGRvY3VtZW50LmRv Y3VtZW50RWxlbWVudC5maXJzdENoaWxkOwogICAgZG9jdW1lbnQub3BlbigpOwogICAgZG9jdW1l bnQuYXBwZW5kQ2hpbGQob0hUTUxFbGVtZW50KQogICAgZG9jdW1lbnQud3JpdGVsbigiPG9iamVj dD4iICsgCiAgICAiPHN0eWxlPiIgKyAKICAgICJAcGFnZSAge2JvcmRlci1yaWdodDogdGhpY2s7 fSIgKwogICAgIioge2JvcmRlci1yaWdodDogbWVkaXVtIGRhc2hlZDt9IiArCiAgICAiPC9zdHls ZT4iKQogICAgbG9jYXRpb24ucmVsb2FkKCk7CiAgfQo8L3NjcmlwdD4KPGJvZHkgb25sb2FkPSJn bygpIj4= 78279 2011-01-07 15:08:15 -0800 2011-01-07 16:32:33 -0800 Patch documentwrite.patch text/plain 4407 eae SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA3NTI3OCkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMjAgQEAKKzIwMTEtMDEtMDcgIEVtaWwgRWtsdW5kICA8ZWFlQGNocm9taXVtLm9y Zz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBDcmFz aCBpbiBkb2N1bWVudC53cml0ZSB3aGVuIGFwcGVuZGluZyBub2RlcyBpbiBiZXR3ZWVuIGNhbGwg dG8gb3BlbiBhbmQgd3JpdGUuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3df YnVnLmNnaT9pZD01MTY0NworCisgICAgICAgIFRlc3Q6IGZhc3QvZG9tL2RvY3VtZW50LXdyaXRl LWFmdGVyLWFwcGVuZC5odG1sCisKKyAgICAgICAgKiBkb20vRG9jdW1lbnQuY3BwOgorICAgICAg ICAoV2ViQ29yZTo6RG9jdW1lbnQ6OkRvY3VtZW50KToKKyAgICAgICAgKFdlYkNvcmU6OkRvY3Vt ZW50OjpjaGlsZHJlbkNoYW5nZWQpOgorICAgICAgICAoV2ViQ29yZTo6RG9jdW1lbnQ6Om9wZW4p OgorICAgICAgICAoV2ViQ29yZTo6RG9jdW1lbnQ6OmNsb3NlKToKKyAgICAgICAgKFdlYkNvcmU6 OkRvY3VtZW50Ojp3cml0ZSk6IENoZWNrIGlmIG1fZXhwbGljaXRPcGVuIGlzIHNldCBpbnN0ZWFk IG9mIHJlbHlpbmcgc29sZWx5IG9uIGhhc0luc2VydGlvblBvaW50LgorICAgICAgICAqIGRvbS9E b2N1bWVudC5oOiBBZGQgbV9leHBsaWNpdE9wZW4gZmllbGQuCisKIDIwMTEtMDEtMDcgIEphbWVz IFJvYmluc29uICA8amFtZXNyQGNocm9taXVtLm9yZz4KIAogICAgICAgICBGaXggY29tcGlsZSBi dXN0YWdlIGR1ZSB0byBiYWQgbWVyZ2UgaW4gNzUyNzYuCkluZGV4OiBXZWJDb3JlL2RvbS9Eb2N1 bWVudC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9kb20vRG9jdW1lbnQuY3BwCShyZXZpc2lv biA3NDcxMykKKysrIFdlYkNvcmUvZG9tL0RvY3VtZW50LmNwcAkod29ya2luZyBjb3B5KQpAQCAt NDE4LDYgKzQxOCw3IEBAIERvY3VtZW50OjpEb2N1bWVudChGcmFtZSogZnJhbWUsIGNvbnN0IEsK ICAgICAsIG1fbG9hZEV2ZW50RGVsYXlUaW1lcih0aGlzLCAmRG9jdW1lbnQ6OmxvYWRFdmVudERl bGF5VGltZXJGaXJlZCkKICAgICAsIG1fZGlyZWN0aW9uU2V0T25Eb2N1bWVudEVsZW1lbnQoZmFs c2UpCiAgICAgLCBtX3dyaXRpbmdNb2RlU2V0T25Eb2N1bWVudEVsZW1lbnQoZmFsc2UpCisgICAg LCBtX2V4cGxpY2l0T3BlbihmYWxzZSkKIHsKICAgICBtX2RvY3VtZW50ID0gdGhpczsKIApAQCAt Njg4LDYgKzY4OSw5IEBAIHZvaWQgRG9jdW1lbnQ6OmNoaWxkcmVuQ2hhbmdlZChib29sIGNoYW4K ICAgICAKICAgICAvLyBJbnZhbGlkYXRlIHRoZSBkb2N1bWVudCBlbGVtZW50IHdlIGhhdmUgY2Fj aGVkIGluIGNhc2UgaXQgd2FzIHJlcGxhY2VkLgogICAgIG1fZG9jdW1lbnRFbGVtZW50ID0gMDsK KworICAgIGlmICghY2hhbmdlZEJ5UGFyc2VyKQorICAgICAgICBtX2V4cGxpY2l0T3BlbiA9IGZh bHNlOwogfQogCiB2b2lkIERvY3VtZW50OjpjYWNoZURvY3VtZW50RWxlbWVudCgpIGNvbnN0CkBA IC0xOTYxLDYgKzE5NjUsOCBAQCB2b2lkIERvY3VtZW50OjpvcGVuKERvY3VtZW50KiBvd25lckRv Y3VtCiAKICAgICBpZiAobV9mcmFtZSkKICAgICAgICAgbV9mcmFtZS0+bG9hZGVyKCktPmRpZEV4 cGxpY2l0T3BlbigpOworCisgICAgbV9leHBsaWNpdE9wZW4gPSB0cnVlOwogfQogCiB2b2lkIERv Y3VtZW50OjpkZXRhY2hQYXJzZXIoKQpAQCAtMjA2NCw2ICsyMDcwLDcgQEAgdm9pZCBEb2N1bWVu dDo6Y2xvc2UoKQogICAgICAgICAvLyB0aGUgbG9hZCBldmVudCBwcmVtYXR1cmVseSA8aHR0cDov L2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTQ1Njg+LgogICAgICAgICBpbXBsaWNp dENsb3NlKCk7CiAgICAgfQorICAgIG1fZXhwbGljaXRPcGVuID0gZmFsc2U7CiB9CiAKIHZvaWQg RG9jdW1lbnQ6OmltcGxpY2l0Q2xvc2UoKQpAQCAtMjIyMyw3ICsyMjMwLDcgQEAgdm9pZCBEb2N1 bWVudDo6d3JpdGUoY29uc3QgU2VnbWVudGVkU3RyaQogICAgIGlmICghaGFzSW5zZXJ0aW9uUG9p bnQgJiYgbV9pZ25vcmVEZXN0cnVjdGl2ZVdyaXRlQ291bnQpCiAgICAgICAgIHJldHVybjsKIAot ICAgIGlmICghaGFzSW5zZXJ0aW9uUG9pbnQpCisgICAgaWYgKCFoYXNJbnNlcnRpb25Qb2ludCB8 fCAhbV9leHBsaWNpdE9wZW4pCiAgICAgICAgIG9wZW4ob3duZXJEb2N1bWVudCk7CiAKICAgICBB U1NFUlQobV9wYXJzZXIpOwpJbmRleDogV2ViQ29yZS9kb20vRG9jdW1lbnQuaAo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBXZWJDb3JlL2RvbS9Eb2N1bWVudC5oCShyZXZpc2lvbiA3NDcxMykKKysrIFdlYkNvcmUv ZG9tL0RvY3VtZW50LmgJKHdvcmtpbmcgY29weSkKQEAgLTEyNjgsNiArMTI2OCw3IEBAIHByaXZh dGU6CiAgICAgRWxlbWVudCogbV9jc3NUYXJnZXQ7CiAgICAgCiAgICAgYm9vbCBtX3Byb2Nlc3Np bmdMb2FkRXZlbnQ7CisgICAgYm9vbCBtX2V4cGxpY2l0T3BlbjsKICAgICBSZWZQdHI8U2VyaWFs aXplZFNjcmlwdFZhbHVlPiBtX3BlbmRpbmdTdGF0ZU9iamVjdDsKICAgICBkb3VibGUgbV9zdGFy dFRpbWU7CiAgICAgYm9vbCBtX292ZXJNaW5pbXVtTGF5b3V0VGhyZXNob2xkOwpJbmRleDogTGF5 b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL0NoYW5nZUxvZwko cmV2aXNpb24gNzUyNzgpCisrKyBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHdvcmtpbmcgY29weSkK QEAgLTEsMyArMSwxMyBAQAorMjAxMS0wMS0wNyAgRW1pbCBFa2x1bmQgIDxlYWVAY2hyb21pdW0u b3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEFk ZCB0ZXN0IGZvciBhcHBlbmRpbmcgbm9kZXMgaW4gYmV0d2VlbiBjYWxscyB0byBkb2N1bWVudC5v cGVuIGFuZCBkb2N1bWVudC53cml0ZS4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTUxNjQ3CisKKyAgICAgICAgKiBmYXN0L2RvbS9kb2N1bWVudC13cml0 ZS1hZnRlci1hcHBlbmQtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2RvbS9k b2N1bWVudC13cml0ZS1hZnRlci1hcHBlbmQuaHRtbDogQWRkZWQuCisKIDIwMTEtMDEtMDUgIEpl ciBOb2JsZSAgPGplckBrb2tvZGUuYXBwbGUuY29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5IFNp bW9uIEZyYXNlci4KSW5kZXg6IExheW91dFRlc3RzL2Zhc3QvZG9tL2RvY3VtZW50LXdyaXRlLWFm dGVyLWFwcGVuZC1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9k b20vZG9jdW1lbnQtd3JpdGUtYWZ0ZXItYXBwZW5kLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkK KysrIExheW91dFRlc3RzL2Zhc3QvZG9tL2RvY3VtZW50LXdyaXRlLWFmdGVyLWFwcGVuZC1leHBl Y3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEgQEAKK1Nob3VsZCBub3QgY3Jhc2guCklu ZGV4OiBMYXlvdXRUZXN0cy9mYXN0L2RvbS9kb2N1bWVudC13cml0ZS1hZnRlci1hcHBlbmQuaHRt bAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L2RvbS9kb2N1bWVudC13cml0ZS1hZnRl ci1hcHBlbmQuaHRtbAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Zhc3QvZG9tL2RvY3Vt ZW50LXdyaXRlLWFmdGVyLWFwcGVuZC5odG1sCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDEwIEBA Cis8c2NyaXB0PgorICAgIGlmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpCisgICAgICAg IGxheW91dFRlc3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKKyAgICBmdW5jdGlvbiBnbygpIHsK KyAgICAgICAgZG9jdW1lbnQub3BlbigpOworICAgICAgICBkb2N1bWVudC5hcHBlbmRDaGlsZChk b2N1bWVudC5jcmVhdGVFbGVtZW50KCdkaXYnKSk7CisgICAgICAgIGRvY3VtZW50LndyaXRlbG4o IjxzcGFuPlNob3VsZCBub3QgY3Jhc2guPC9zcGFuPiIpOworICAgIH0KKzwvc2NyaXB0PgorPGJv ZHkgb25sb2FkPSJnbygpIj4K