53900 2011-02-06 19:40:56 -0800 REGRESSION(r77740): CSSStyleSelector accessing deleted memory for svg/dom/use-transform.svg 2011-02-12 15:04:23 -0800 1 1 1 Unclassified WebKit CSS 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 1 kling webkit-unassigned abarth darin eric hyatt koivisto simon.fraser webkit.review.bot oldest_to_newest 346439 0 kling 2011-02-06 19:40:56 -0800 svg/dom/use-transform.svg is currently crashing intermittently on the Qt bot. The CSSStyleSelector* stored in the StyleSelectorParentPusher is deleted below recalcStyle(). A valgrind trace for your convenience: ==8437== Invalid read of size 4 ==8437== at 0x47336F7: WebCore::CSSStyleSelector::popParent(WebCore::Element*) (Vector.h:530) ==8437== by 0x47ADDF2: WebCore::Element::recalcStyle(WebCore::Node::StyleChange) (Element.cpp:89) ==8437== by 0x478BB36: WebCore::Document::recalcStyle(WebCore::Node::StyleChange) (Document.cpp:1527) ==8437== by 0x478017A: WebCore::Document::updateStyleIfNeeded() (Document.cpp:1569) ==8437== by 0x47809D6: WebCore::Document::updateLayout() (Document.cpp:1596) ==8437== by 0x4791678: WebCore::Document::updateLayoutIgnorePendingStylesheets() (Document.cpp:1632) ==8437== by 0x4DAD667: WebCore::SVGElementInstance::invalidateAllInstancesOfElement(WebCore::SVGElement*) (SVGElementInstance.cpp:111) ==8437== by 0x4E20C2B: WebCore::SVGStyledElement::svgAttributeChanged(WebCore::QualifiedName const&) (SVGStyledElement.cpp:256) ==8437== by 0x4DE65DB: WebCore::SVGGElement::svgAttributeChanged(WebCore::QualifiedName const&) (SVGGElement.cpp:60) ==8437== by 0x4DAAC8F: WebCore::SVGElement::attributeChanged(WebCore::Attribute*, bool) (SVGElement.cpp:358) ==8437== by 0x47AAE23: WebCore::Element::setAttribute(WTF::AtomicString const&, WTF::AtomicString const&, int&) (Element.cpp:664) ==8437== by 0x42AA202: WebCore::jsElementPrototypeFunctionSetAttribute(JSC::ExecState*) (in /home/kling/src/webkit/WebKitBuild/Release/lib/libQtWebKit.so.4.9.0) ==8437== Address 0xe999e88 is 32 bytes inside a block of size 780 free'd ==8437== at 0x40257ED: free (vg_replace_malloc.c:366) ==8437== by 0x4EAC5AC: WTF::fastFree(void*) (in /home/kling/src/webkit/WebKitBuild/Release/lib/libQtWebKit.so.4.9.0) ==8437== by 0x4790446: WebCore::Document::recalcStyleSelector() (CSSStyleSelector.h:87) ==8437== by 0x47909AE: WebCore::Document::styleSelectorChanged(WebCore::StyleSelectorUpdateFlag) (Document.cpp:2866) ==8437== by 0x48F1700: WebCore::HTMLLinkElement::removedFromDocument() (in /home/kling/src/webkit/WebKitBuild/Release/lib/libQtWebKit.so.4.9.0) ==8437== by 0x477697A: WebCore::ContainerNode::removedFromDocument() (ContainerNode.cpp:743) ==8437== by 0x47AE67A: WebCore::Element::removedFromDocument() (Element.cpp:918) ==8437== by 0x477697A: WebCore::ContainerNode::removedFromDocument() (ContainerNode.cpp:743) ==8437== by 0x47AE67A: WebCore::Element::removedFromDocument() (Element.cpp:918) ==8437== by 0x477697A: WebCore::ContainerNode::removedFromDocument() (ContainerNode.cpp:743) ==8437== by 0x47AE67A: WebCore::Element::removedFromDocument() (Element.cpp:918) ==8437== by 0x4E20555: WebCore::SVGStyledElement::removedFromDocument() (SVGStyledElement.cpp:284) ==8437== by 0x477697A: WebCore::ContainerNode::removedFromDocument() (ContainerNode.cpp:743) ==8437== by 0x47AE67A: WebCore::Element::removedFromDocument() (Element.cpp:918) ==8437== by 0x4E20555: WebCore::SVGStyledElement::removedFromDocument() (SVGStyledElement.cpp:284) ==8437== by 0x4776010: void WebCore::Private::addChildNodesToDeletionQueue<WebCore::Node, WebCore::ContainerNode>(WebCore::Node*&, WebCore::Node*&, WebCore::ContainerNode*) (ContainerNodeAlgorithms.h:99) ==8437== by 0x4776051: WebCore::ContainerNode::removeAllChildren() (ContainerNodeAlgorithms.h:47) ==8437== by 0x4D6A08C: WebCore::RenderSVGShadowTreeRootContainer::updateFromElement() (in /home/kling/src/webkit/WebKitBuild/Release/lib/libQtWebKit.so.4.9.0) ==8437== by 0x4E3A328: WebCore::SVGUseElement::recalcStyle(WebCore::Node::StyleChange) (SVGUseElement.cpp:354) ==8437== by 0x47ADD1D: WebCore::Element::recalcStyle(WebCore::Node::StyleChange) (Element.cpp:1106) ==8437== by 0x478BB36: WebCore::Document::recalcStyle(WebCore::Node::StyleChange) (Document.cpp:1527) ==8437== by 0x478017A: WebCore::Document::updateStyleIfNeeded() (Document.cpp:1569) ==8437== by 0x47809D6: WebCore::Document::updateLayout() (Document.cpp:1596) ==8437== by 0x4791678: WebCore::Document::updateLayoutIgnorePendingStylesheets() (Document.cpp:1632) ==8437== by 0x4DAD667: WebCore::SVGElementInstance::invalidateAllInstancesOfElement(WebCore::SVGElement*) (SVGElementInstance.cpp:111) ==8437== by 0x4E20C2B: WebCore::SVGStyledElement::svgAttributeChanged(WebCore::QualifiedName const&) (SVGStyledElement.cpp:256) ==8437== by 0x4DE65DB: WebCore::SVGGElement::svgAttributeChanged(WebCore::QualifiedName const&) (SVGGElement.cpp:60) ==8437== by 0x4DAAC8F: WebCore::SVGElement::attributeChanged(WebCore::Attribute*, bool) (SVGElement.cpp:358) ==8437== by 0x47AAE23: WebCore::Element::setAttribute(WTF::AtomicString const&, WTF::AtomicString const&, int&) (Element.cpp:664) ==8437== by 0x42AA202: WebCore::jsElementPrototypeFunctionSetAttribute(JSC::ExecState*) (in /home/kling/src/webkit/WebKitBuild/Release/lib/libQtWebKit.so.4.9.0) 346550 1 koivisto 2011-02-07 05:53:21 -0800 Silly svg code manages to do a styleselector update in the middle of a style recalc. That's totally wrong. 346602 2 simon.fraser 2011-02-07 08:35:04 -0800 We should make that assert as well as fixing the crash. 346626 3 81482 koivisto 2011-02-07 09:30:53 -0800 Created attachment 81482 possible fix Kling, could you try if this silences valgrind? 346701 4 kling 2011-02-07 11:48:51 -0800 (In reply to comment #3) > Kling, could you try if this silences valgrind? It does indeed! 346707 5 81482 kling 2011-02-07 12:02:11 -0800 Comment on attachment 81482 possible fix r=me 346709 6 koivisto 2011-02-07 12:09:12 -0800 http://trac.webkit.org/changeset/77834 346751 7 webkit.review.bot 2011-02-07 13:09:29 -0800 http://trac.webkit.org/changeset/77834 might have broken GTK Linux 64-bit Debug 350320 8 darin 2011-02-12 15:04:23 -0800 On my computer at least, an assertion is firing in this new code. See bug 54344 for details. 81482 2011-02-07 09:30:53 -0800 2011-02-07 12:02:11 -0800 possible fix svg-shadow-link-crash.patch text/plain 5225 koivisto SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDc3ODE5KQorKysgU291cmNlL1dlYkNvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMjcgQEAKKzIwMTEtMDItMDcgIEFudHRpIEtv aXZpc3RvICA8YW50dGlAYXBwbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgIFJFR1JFU1NJT04ocjc3NzQwKTogQ1NTU3R5bGVTZWxlY3RvciBh Y2Nlc3NpbmcgZGVsZXRlZCBtZW1vcnkgZm9yIHN2Zy9kb20vdXNlLXRyYW5zZm9ybS5zdmcKKyAg ICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTUzOTAwCisgICAg ICAgIAorICAgICAgICBJZ25vcmUgbGluayBlbGVtZW50cyBpbiBzaGFkb3cgdHJlZXMuCisKKyAg ICAgICAgKiBkb20vRWxlbWVudC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpTdHlsZVNlbGVjdG9y UGFyZW50UHVzaGVyOjpTdHlsZVNlbGVjdG9yUGFyZW50UHVzaGVyKToKKyAgICAgICAgKFdlYkNv cmU6OlN0eWxlU2VsZWN0b3JQYXJlbnRQdXNoZXI6On5TdHlsZVNlbGVjdG9yUGFyZW50UHVzaGVy KToKKyAgICAgICAgICAgICAgICAKKyAgICAgICAgICAgIFNvbWUgYXNzZXJ0cyB0byBjYXRjaCBj YXNlcyBsaWtlIHRoaXMuCisKKyAgICAgICAgKFdlYkNvcmU6OkVsZW1lbnQ6OmF0dGFjaCk6Cisg ICAgICAgIChXZWJDb3JlOjpFbGVtZW50OjpyZWNhbGNTdHlsZSk6CisgICAgICAgICogaHRtbC9I VE1MTGlua0VsZW1lbnQuY3BwOgorICAgICAgICAoV2ViQ29yZTo6SFRNTExpbmtFbGVtZW50OjpI VE1MTGlua0VsZW1lbnQpOgorICAgICAgICAoV2ViQ29yZTo6SFRNTExpbmtFbGVtZW50Ojpwcm9j ZXNzKToKKyAgICAgICAgKFdlYkNvcmU6OkhUTUxMaW5rRWxlbWVudDo6aW5zZXJ0ZWRJbnRvRG9j dW1lbnQpOgorICAgICAgICAoV2ViQ29yZTo6SFRNTExpbmtFbGVtZW50OjpyZW1vdmVkRnJvbURv Y3VtZW50KToKKyAgICAgICAgKiBodG1sL0hUTUxMaW5rRWxlbWVudC5oOgorCiAyMDExLTAyLTA2 ICBEYXJpbiBBZGxlciAgPGRhcmluQGFwcGxlLmNvbT4KIAogICAgICAgICBSZXZpZXdlZCBieSBB bnR0aSBLb2l2aXN0by4KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2RvbS9FbGVtZW50LmNwcAo9PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9kb20vRWxlbWVudC5jcHAJKHJldmlzaW9uIDc3Nzc2 KQorKysgU291cmNlL1dlYkNvcmUvZG9tL0VsZW1lbnQuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC03 MCwyOSArNzAsMzAgQEAgdXNpbmcgbmFtZXNwYWNlIFhNTE5hbWVzOwogICAgIAogY2xhc3MgU3R5 bGVTZWxlY3RvclBhcmVudFB1c2hlciB7CiBwdWJsaWM6Ci0gICAgU3R5bGVTZWxlY3RvclBhcmVu dFB1c2hlcihDU1NTdHlsZVNlbGVjdG9yKiBzdHlsZVNlbGVjdG9yLCBFbGVtZW50KiBwYXJlbnQp Ci0gICAgICAgIDogbV9zdHlsZVNlbGVjdG9yKHN0eWxlU2VsZWN0b3IpCi0gICAgICAgICwgbV9w YXJlbnQocGFyZW50KQotICAgICAgICAsIG1fZGlkUHVzaChmYWxzZSkgCisgICAgU3R5bGVTZWxl Y3RvclBhcmVudFB1c2hlcihFbGVtZW50KiBwYXJlbnQpCisgICAgICAgIDogbV9wYXJlbnQocGFy ZW50KQorICAgICAgICAsIG1fcHVzaGVkU3R5bGVTZWxlY3RvcigwKQogICAgIHsKICAgICB9CiAg ICAgdm9pZCBwdXNoKCkKICAgICB7Ci0gICAgICAgIGlmIChtX2RpZFB1c2gpCisgICAgICAgIGlm IChtX3B1c2hlZFN0eWxlU2VsZWN0b3IpCiAgICAgICAgICAgICByZXR1cm47Ci0gICAgICAgIG1f c3R5bGVTZWxlY3Rvci0+cHVzaFBhcmVudChtX3BhcmVudCk7Ci0gICAgICAgIG1fZGlkUHVzaCA9 IHRydWU7CisgICAgICAgIG1fcHVzaGVkU3R5bGVTZWxlY3RvciA9IG1fcGFyZW50LT5kb2N1bWVu dCgpLT5zdHlsZVNlbGVjdG9yKCk7CisgICAgICAgIG1fcHVzaGVkU3R5bGVTZWxlY3Rvci0+cHVz aFBhcmVudChtX3BhcmVudCk7CiAgICAgfQogICAgIH5TdHlsZVNlbGVjdG9yUGFyZW50UHVzaGVy KCkgCiAgICAgewotICAgICAgICBpZiAobV9kaWRQdXNoKQotICAgICAgICAgICAgbV9zdHlsZVNl bGVjdG9yLT5wb3BQYXJlbnQobV9wYXJlbnQpOyAKKworICAgICAgICBpZiAoIW1fcHVzaGVkU3R5 bGVTZWxlY3RvcikKKyAgICAgICAgICAgIHJldHVybjsKKyAgICAgICAgQVNTRVJUKG1fcHVzaGVk U3R5bGVTZWxlY3RvciA9PSBtX3BhcmVudC0+ZG9jdW1lbnQoKS0+c3R5bGVTZWxlY3RvcigpKTsK KyAgICAgICAgbV9wdXNoZWRTdHlsZVNlbGVjdG9yLT5wb3BQYXJlbnQobV9wYXJlbnQpOyAKICAg ICB9CiAKIHByaXZhdGU6Ci0gICAgQ1NTU3R5bGVTZWxlY3RvciogbV9zdHlsZVNlbGVjdG9yOwog ICAgIEVsZW1lbnQqIG1fcGFyZW50OwotICAgIGJvb2wgbV9kaWRQdXNoOworICAgIENTU1N0eWxl U2VsZWN0b3IqIG1fcHVzaGVkU3R5bGVTZWxlY3RvcjsKIH07CiAgICAgCiBQYXNzUmVmUHRyPEVs ZW1lbnQ+IEVsZW1lbnQ6OmNyZWF0ZShjb25zdCBRdWFsaWZpZWROYW1lJiB0YWdOYW1lLCBEb2N1 bWVudCogZG9jdW1lbnQpCkBAIC05NDUsNyArOTQ2LDcgQEAgdm9pZCBFbGVtZW50OjphdHRhY2go KQogCiAgICAgY3JlYXRlUmVuZGVyZXJJZk5lZWRlZCgpOwogICAgIAotICAgIFN0eWxlU2VsZWN0 b3JQYXJlbnRQdXNoZXIgcGFyZW50UHVzaGVyKGRvY3VtZW50KCktPnN0eWxlU2VsZWN0b3IoKSwg dGhpcyk7CisgICAgU3R5bGVTZWxlY3RvclBhcmVudFB1c2hlciBwYXJlbnRQdXNoZXIodGhpcyk7 CiAgICAgaWYgKGZpcnN0Q2hpbGQoKSkKICAgICAgICAgcGFyZW50UHVzaGVyLnB1c2goKTsKICAg ICBDb250YWluZXJOb2RlOjphdHRhY2goKTsKQEAgLTEwOTIsNyArMTA5Myw3IEBAIHZvaWQgRWxl bWVudDo6cmVjYWxjU3R5bGUoU3R5bGVDaGFuZ2UgY2gKICAgICAgICAgICAgICAgICBjaGFuZ2Ug PSBjaDsKICAgICAgICAgfQogICAgIH0KLSAgICBTdHlsZVNlbGVjdG9yUGFyZW50UHVzaGVyIHBh cmVudFB1c2hlcihkb2N1bWVudCgpLT5zdHlsZVNlbGVjdG9yKCksIHRoaXMpOworICAgIFN0eWxl U2VsZWN0b3JQYXJlbnRQdXNoZXIgcGFyZW50UHVzaGVyKHRoaXMpOwogICAgIC8vIEZJWE1FOiBU aGlzIGNoZWNrIGlzIGdvb2QgZW5vdWdoIGZvciA6aG92ZXIgKyBmb28sIGJ1dCBpdCBpcyBub3Qg Z29vZCBlbm91Z2ggZm9yIDpob3ZlciArIGZvbyArIGJhci4KICAgICAvLyBGb3Igbm93IHdlIHdp bGwganVzdCB3b3JyeSBhYm91dCB0aGUgY29tbW9uIGNhc2UsIHNpbmNlIGl0J3MgYSBsb3QgdHJp Y2tpZXIgdG8gZ2V0IHRoZSBzZWNvbmQgY2FzZSByaWdodAogICAgIC8vIHdpdGhvdXQgZG9pbmcg d2F5IHRvbyBtdWNoIHJlLXJlc29sdXRpb24uCkluZGV4OiBTb3VyY2UvV2ViQ29yZS9odG1sL0hU TUxMaW5rRWxlbWVudC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvaHRtbC9IVE1M TGlua0VsZW1lbnQuY3BwCShyZXZpc2lvbiA3Nzc3NikKKysrIFNvdXJjZS9XZWJDb3JlL2h0bWwv SFRNTExpbmtFbGVtZW50LmNwcAkod29ya2luZyBjb3B5KQpAQCAtNTYsNiArNTYsNyBAQCBpbmxp bmUgSFRNTExpbmtFbGVtZW50OjpIVE1MTGlua0VsZW1lbnQoCiAgICAgLCBtX2Rpc2FibGVkU3Rh dGUoVW5zZXQpCiAgICAgLCBtX2xvYWRpbmcoZmFsc2UpCiAgICAgLCBtX2NyZWF0ZWRCeVBhcnNl cihjcmVhdGVkQnlQYXJzZXIpCisgICAgLCBtX2lzSW5TaGFkb3dUcmVlKGZhbHNlKQogICAgICwg bV9wZW5kaW5nU2hlZXRUeXBlKE5vbmUpCiB7CiAgICAgQVNTRVJUKGhhc1RhZ05hbWUobGlua1Rh ZykpOwpAQCAtMTk0LDcgKzE5NSw3IEBAIHZvaWQgSFRNTExpbmtFbGVtZW50Ojp0b2tlbml6ZVJl bEF0dHJpYnUKIAogdm9pZCBIVE1MTGlua0VsZW1lbnQ6OnByb2Nlc3MoKQogewotICAgIGlmICgh aW5Eb2N1bWVudCgpKSB7CisgICAgaWYgKCFpbkRvY3VtZW50KCkgfHwgbV9pc0luU2hhZG93VHJl ZSkgewogICAgICAgICBBU1NFUlQoIW1fc2hlZXQpOwogICAgICAgICByZXR1cm47CiAgICAgfQpA QCAtMjgwLDYgKzI4MSwxMSBAQCB2b2lkIEhUTUxMaW5rRWxlbWVudDo6cHJvY2VzcygpCiB2b2lk IEhUTUxMaW5rRWxlbWVudDo6aW5zZXJ0ZWRJbnRvRG9jdW1lbnQoKQogewogICAgIEhUTUxFbGVt ZW50OjppbnNlcnRlZEludG9Eb2N1bWVudCgpOworCisgICAgbV9pc0luU2hhZG93VHJlZSA9IGlz SW5TaGFkb3dUcmVlKCk7CisgICAgaWYgKG1faXNJblNoYWRvd1RyZWUpCisgICAgICAgIHJldHVy bjsKKwogICAgIGRvY3VtZW50KCktPmFkZFN0eWxlU2hlZXRDYW5kaWRhdGVOb2RlKHRoaXMsIG1f Y3JlYXRlZEJ5UGFyc2VyKTsKIAogICAgIHByb2Nlc3MoKTsKQEAgLTI4OSw2ICsyOTUsMTAgQEAg dm9pZCBIVE1MTGlua0VsZW1lbnQ6OnJlbW92ZWRGcm9tRG9jdW1lbgogewogICAgIEhUTUxFbGVt ZW50OjpyZW1vdmVkRnJvbURvY3VtZW50KCk7CiAKKyAgICBpZiAobV9pc0luU2hhZG93VHJlZSkg eworICAgICAgICBBU1NFUlQoIW1fc2hlZXQpOworICAgICAgICByZXR1cm47CisgICAgfQogICAg IGRvY3VtZW50KCktPnJlbW92ZVN0eWxlU2hlZXRDYW5kaWRhdGVOb2RlKHRoaXMpOwogCiAgICAg aWYgKG1fc2hlZXQpIHsKSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2h0bWwvSFRNTExpbmtFbGVtZW50 LmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvaHRtbC9IVE1MTGlua0VsZW1lbnQuaAko cmV2aXNpb24gNzc3NzYpCisrKyBTb3VyY2UvV2ViQ29yZS9odG1sL0hUTUxMaW5rRWxlbWVudC5o CSh3b3JraW5nIGNvcHkpCkBAIC0xMzUsNiArMTM1LDcgQEAgcHJpdmF0ZToKICAgICBSZWxBdHRy aWJ1dGUgbV9yZWxBdHRyaWJ1dGU7CiAgICAgYm9vbCBtX2xvYWRpbmc7CiAgICAgYm9vbCBtX2Ny ZWF0ZWRCeVBhcnNlcjsKKyAgICBib29sIG1faXNJblNoYWRvd1RyZWU7CiAgICAgCiAgICAgUGVu ZGluZ1NoZWV0VHlwZSBtX3BlbmRpbmdTaGVldFR5cGU7CiB9Owo=