56645 2011-03-18 07:55:32 -0700 Assertion fires when hidden Find-on-Page matches are encountered in WebKit2 2011-03-18 08:31:00 -0700 1 1 1 Unclassified WebKit WebKit2 528+ (Nightly build) All All RESOLVED FIXED http://amazon.com InRadar P2 Normal --- 1 sullivan sullivan jeffm mitz oldest_to_newest 369624 0 sullivan 2011-03-18 07:55:32 -0700 To reproduce: 1. visit amazon.com in a client using a debug build of WebKit2 2. use the Find-on-page UI to search for "the" 3. (If necessary), do Find Again a few times An assertion fires: ASSERTION FAILED: size Thread 0 Crashed: Dispatch queue: com.apple.main-thread 0 com.apple.WebKit2 0x0000000100312b39 WebKit::SharedMemory::create(unsigned long) + 65 (SharedMemoryMac.cpp:94) 1 com.apple.WebKit2 0x00000001003b58c7 WebKit::ShareableBitmap::createShareable(WebCore::IntSize const&) + 47 (ShareableBitmap.cpp:51) 2 com.apple.WebKit2 0x000000010035b397 WebKit::FindController::updateFindIndicator(WebCore::Frame*, bool) + 323 (FindController.cpp:164) 3 com.apple.WebKit2 0x000000010035b942 WebKit::FindController::findString(WTF::String const&, WebKit::FindOptions, unsigned int) + 378 (FindController.cpp:116) 4 com.apple.WebKit2 0x000000010027d47c WebKit::WebPage::findString(WTF::String const&, unsigned int, unsigned int) + 48 (WebPage.cpp:1590) <etc> updateFindIndicator is computing an empty selection rect, and then trying to create a zero-sized ShareableBitmap, which hits the assertion in SharedMemory::create(). I've got a patch forthcoming. 369625 1 86164 sullivan 2011-03-18 07:59:31 -0700 Created attachment 86164 Patch to bail out earlier for empty selection rect 369626 2 sullivan 2011-03-18 08:01:44 -0700 In radar as 9154276. 369627 3 mitz 2011-03-18 08:03:45 -0700 I seem to remember that Jeff Miller fixed a bug like this. Was his fix Windows-specific? Can his change be reverted? 369633 4 sullivan 2011-03-18 08:16:05 -0700 I found Jeff's fix -- it is <http://trac.webkit.org/changeset/77091>. Jeff's fix prevented a crash after creating a zero-sized ShareableBitmap in this same updateFindIndicator function. This fix prevents an assertion while trying to create a zero-sized ShareableBitmap. svn blame reveals that the assertion was added after Jeff's fix, in 77968. I think both tests are valid. It's good to bail out as soon as possible by testing for the empty selection rect (my fix). It's also good to bail out if the attempt to create a ShareableBitmap fails (perhaps there is some failure possibility other than zero-size-ness). 369640 5 sullivan 2011-03-18 08:31:00 -0700 Fixed in <http://trac.webkit.org/changeset/81472>. 86164 2011-03-18 07:59:31 -0700 2011-03-18 08:21:17 -0700 Patch to bail out earlier for empty selection rect findAssertion_patch.txt text/plain 1623 sullivan SW5kZXg6IFNvdXJjZS9XZWJLaXQyL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi S2l0Mi9DaGFuZ2VMb2cJKHJldmlzaW9uIDgxNDY5KQorKysgU291cmNlL1dlYktpdDIvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTYgQEAKKzIwMTEtMDMtMTggIEpvaG4gU3Vs bGl2YW4gIDxzdWxsaXZhbkBhcHBsZS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp P2lkPTU2NjQ1CisgICAgICAgIEFzc2VydGlvbiBmaXJlcyB3aGVuIGhpZGRlbiBGaW5kLW9uLVBh Z2UgbWF0Y2hlcyBhcmUgZW5jb3VudGVyZWQgaW4gV2ViS2l0MgorCisgICAgICAgICogV2ViUHJv Y2Vzcy9XZWJQYWdlL0ZpbmRDb250cm9sbGVyLmNwcDoKKyAgICAgICAgKFdlYktpdDo6RmluZENv bnRyb2xsZXI6OnVwZGF0ZUZpbmRJbmRpY2F0b3IpOgorICAgICAgICBCYWlsIG91dCBpZiB0aGUg c2VsZWN0aW9uIHJlY3QgaXMgZW1wdHksIGJlZm9yZSB0cnlpbmcgdG8gZ2VuZXJhdGUgYW4gYXBw cm9wcmlhdGVseS1zaXplZAorICAgICAgICBiaXRtYXAuIChQcmV2aW91c2x5IGl0IHdhcyBiYWls aW5nIG91dCBhZnRlcndhcmRzLCBidXQgZW5jb3VudGVyaW5nIGFuIGFzc2VydGlvbiBpbiBkZWJ1 ZworICAgICAgICBidWlsZHMgYWxvbmcgdGhlIHdheS4pCisKIDIwMTEtMDMtMTggIE1hcmsgUm93 ZSAgPG1yb3dlQGFwcGxlLmNvbT4KIAogICAgICAgICBSdWJiZXItc3RhbXBlZCBieSBKb24gSG9u ZXljdXR0LgpJbmRleDogU291cmNlL1dlYktpdDIvV2ViUHJvY2Vzcy9XZWJQYWdlL0ZpbmRDb250 cm9sbGVyLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViS2l0Mi9XZWJQcm9jZXNzL1dlYlBh Z2UvRmluZENvbnRyb2xsZXIuY3BwCShyZXZpc2lvbiA4MTQ2MykKKysrIFNvdXJjZS9XZWJLaXQy L1dlYlByb2Nlc3MvV2ViUGFnZS9GaW5kQ29udHJvbGxlci5jcHAJKHdvcmtpbmcgY29weSkKQEAg LTE1Myw2ICsxNTMsMTAgQEAgYm9vbCBGaW5kQ29udHJvbGxlcjo6dXBkYXRlRmluZEluZGljYXRv cgogICAgICAgICByZXR1cm4gZmFsc2U7CiAKICAgICBJbnRSZWN0IHNlbGVjdGlvblJlY3QgPSBl bmNsb3NpbmdJbnRSZWN0KHNlbGVjdGVkRnJhbWUtPnNlbGVjdGlvbigpLT5ib3VuZHMoKSk7Cisg ICAgCisgICAgLy8gU2VsZWN0aW9uIHJlY3QgY2FuIGJlIGVtcHR5IGZvciBtYXRjaGVzIHRoYXQg YXJlIGN1cnJlbnRseSBvYnNjdXJlZCBmcm9tIHZpZXcuCisgICAgaWYgKHNlbGVjdGlvblJlY3Qu aXNFbXB0eSgpKQorICAgICAgICByZXR1cm4gZmFsc2U7CiAKICAgICAvLyBXZSB3YW50IHRoZSBz ZWxlY3Rpb24gcmVjdCBpbiB3aW5kb3cgY29vcmRpbmF0ZXMuCiAgICAgSW50UmVjdCBzZWxlY3Rp b25SZWN0SW5XaW5kb3dDb29yZGluYXRlcyA9IHNlbGVjdGVkRnJhbWUtPnZpZXcoKS0+Y29udGVu dHNUb1dpbmRvdyhzZWxlY3Rpb25SZWN0KTsK