60537 2011-05-10 01:07:26 -0700 containsFloats check missing from hasOverhangingFloats, causes null crash 2011-05-10 10:53:43 -0700 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) All All RESOLVED FIXED InRadar P2 Normal --- 1 inferno inferno abarth eric hyatt jamesr mitz simon.fraser webkit.review.bot oldest_to_newest 401087 0 inferno 2011-05-10 01:07:26 -0700 hasOverhangingFloats can produce true when we don't any floats at all. This happens because we have check like bool hasOverhangingFloats() { return parent() && !hasColumns() && lowestFloatLogicalBottom() > logicalHeight(); } lowestFloatLogicalBottom will return 0- when we dont have any floating objects. however our logicalheight can be less than zero when we have large bottom padding. so this check will return true incorrectly. patch upcoming. 401092 1 inferno 2011-05-10 01:20:24 -0700 I have repro, so we might not need this hack anymore. void RenderBlock::repaintOverhangingFloats(bool paintAllDescendants) { // Repaint any overhanging floats (if we know we're the one to paint them). if (hasOverhangingFloats()) { // We think that we must be in a bad state if m_floatingObjects is nil at this point, so // we assert on Debug builds and nil-check Release builds. ASSERT(m_floatingObjects); if (!m_floatingObjects) return; 401097 2 inferno 2011-05-10 01:30:30 -0700 stack:: #0 0x0000000001b40af1 in WebCore::RenderBlock::markSiblingsWithFloatsForLayout() () #1 0x0000000001b474ca in WebCore::RenderBlock::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) () #2 0x0000000001bc8461 in WebCore::RenderObject::setStyle(WTF::PassRefPtr<WebCore::RenderStyle>) () #3 0x0000000001bc69af in WebCore::RenderObject::setAnimatableStyle(WTF::PassRefPtr<WebCore::RenderStyle>) () #4 0x000000000186ec86 in WebCore::Node::setRenderStyle(WTF::PassRefPtr<WebCore::RenderStyle>) () #5 0x000000000185b232 in WebCore::Element::recalcStyle(WebCore::Node::StyleChange) () #6 0x000000000185b320 in WebCore::Element::recalcStyle(WebCore::Node::StyleChange) () #7 0x000000000149ad69 in WebCore::HTMLFormControlElement::recalcStyle(WebCore::Node::StyleChange) () #8 0x000000000185b320 in WebCore::Element::recalcStyle(WebCore::Node::StyleChange) () #9 0x000000000185b320 in WebCore::Element::recalcStyle(WebCore::Node::StyleChange) () #10 0x000000000185b320 in WebCore::Element::recalcStyle(WebCore::Node::StyleChange) () #11 0x000000000185b320 in WebCore::Element::recalcStyle(WebCore::Node::StyleChange) () 401192 3 92954 inferno 2011-05-10 07:52:46 -0700 Created attachment 92954 Patch 401196 4 inferno 2011-05-10 07:55:17 -0700 The crash was happening because m_floatingObjects was nil in markSiblingsWithFloatsForLayout and we returned true in overhangingfloats. Started after my http://trac.webkit.org/changeset/85876. if (diff == StyleDifferenceLayout && s_canPropagateFloatIntoSibling && !canPropagateFloatIntoSibling && hasOverhangingFloats()) { 268 markAllDescendantsWithFloatsForLayout(); 269 markSiblingsWithFloatsForLayout(); 401199 5 inferno 2011-05-10 07:55:57 -0700 Dan, can you please review. 401255 6 simon.fraser 2011-05-10 09:24:56 -0700 <rdar://problem/9413395> 401263 7 inferno 2011-05-10 09:40:46 -0700 Committed r86160: <http://trac.webkit.org/changeset/86160> 401336 8 webkit.review.bot 2011-05-10 10:53:43 -0700 http://trac.webkit.org/changeset/86160 might have broken SnowLeopard Intel Release (WebKit2 Tests) The following tests are not passing: fast/frames/flattening/frameset-flattening-subframesets.html 92954 2011-05-10 07:52:46 -0700 2011-05-10 09:36:34 -0700 Patch bug-60537-20110510075245.patch text/plain 6494 inferno SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDg2MTM1KQorKysgU291cmNlL1dlYkNvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTcgQEAKKzIwMTEtMDUtMTAgIEFiaGlzaGVr IEFyeWEgIDxpbmZlcm5vQGNocm9taXVtLm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICBBZGQgY29udGFpbnNGbG9hdHMgY2FsbCB0byBoYXNPdmVy aGFuZ2luZ0Zsb2F0cy4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu Y2dpP2lkPTYwNTM3CisKKyAgICAgICAgVGVzdDogZmFzdC9ibG9jay9mbG9hdC9uby1vdmVyaGFu Z2luZy1mbG9hdC1jcmFzaC5odG1sCisKKyAgICAgICAgKiByZW5kZXJpbmcvUmVuZGVyQmxvY2su Y3BwOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVyQmxvY2s6OnJlcGFpbnRPdmVyaGFuZ2luZ0Zs b2F0cyk6CisgICAgICAgICogcmVuZGVyaW5nL1JlbmRlckJsb2NrLmg6CisgICAgICAgIChXZWJD b3JlOjpSZW5kZXJCbG9jazo6aGFzT3ZlcmhhbmdpbmdGbG9hdHMpOgorCiAyMDExLTA1LTA2ICBU b255IEdlbnRpbGNvcmUgIDx0b255Z0BjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgUmV2aWV3ZWQg YnkgRGFyaW4gQWRsZXIuCkluZGV4OiBTb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQmxv Y2suY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJCbG9j ay5jcHAJKHJldmlzaW9uIDg2MDYxKQorKysgU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRl ckJsb2NrLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMjIxNywzMCArMjIxNywyNiBAQCB2b2lkIFJl bmRlckJsb2NrOjptYXJrRm9yUGFnaW5hdGlvblJlbGF5CiB2b2lkIFJlbmRlckJsb2NrOjpyZXBh aW50T3ZlcmhhbmdpbmdGbG9hdHMoYm9vbCBwYWludEFsbERlc2NlbmRhbnRzKQogewogICAgIC8v IFJlcGFpbnQgYW55IG92ZXJoYW5naW5nIGZsb2F0cyAoaWYgd2Uga25vdyB3ZSdyZSB0aGUgb25l IHRvIHBhaW50IHRoZW0pLgotICAgIGlmIChoYXNPdmVyaGFuZ2luZ0Zsb2F0cygpKSB7Ci0gICAg ICAgIC8vIFdlIHRoaW5rIHRoYXQgd2UgbXVzdCBiZSBpbiBhIGJhZCBzdGF0ZSBpZiBtX2Zsb2F0 aW5nT2JqZWN0cyBpcyBuaWwgYXQgdGhpcyBwb2ludCwgc28gCi0gICAgICAgIC8vIHdlIGFzc2Vy dCBvbiBEZWJ1ZyBidWlsZHMgYW5kIG5pbC1jaGVjayBSZWxlYXNlIGJ1aWxkcy4KLSAgICAgICAg QVNTRVJUKG1fZmxvYXRpbmdPYmplY3RzKTsKLSAgICAgICAgaWYgKCFtX2Zsb2F0aW5nT2JqZWN0 cykKLSAgICAgICAgICAgIHJldHVybjsKKyAgICAvLyBPdGhlcndpc2UsIGJhaWwgb3V0LgorICAg IGlmICghaGFzT3ZlcmhhbmdpbmdGbG9hdHMoKSkKKyAgICAgICAgcmV0dXJuOwogCi0gICAgICAg IC8vIEZJWE1FOiBBdm9pZCBkaXNhYmxpbmcgTGF5b3V0U3RhdGUuIEF0IHRoZSB2ZXJ5IGxlYXN0 LCBkb24ndCBkaXNhYmxlIGl0IGZvciBmbG9hdHMgb3JpZ2luYXRpbmcKLSAgICAgICAgLy8gaW4g dGhpcyBibG9jay4gQmV0dGVyIHlldCB3b3VsZCBiZSB0byBwdXNoIGV4dHJhIHN0YXRlIGZvciB0 aGUgY29udGFpbmVycyBvZiBvdGhlciBmbG9hdHMuCi0gICAgICAgIHZpZXcoKS0+ZGlzYWJsZUxh eW91dFN0YXRlKCk7Ci0gICAgICAgIEZsb2F0aW5nT2JqZWN0U2V0JiBmbG9hdGluZ09iamVjdFNl dCA9IG1fZmxvYXRpbmdPYmplY3RzLT5zZXQoKTsKLSAgICAgICAgRmxvYXRpbmdPYmplY3RTZXRJ dGVyYXRvciBlbmQgPSBmbG9hdGluZ09iamVjdFNldC5lbmQoKTsKLSAgICAgICAgZm9yIChGbG9h dGluZ09iamVjdFNldEl0ZXJhdG9yIGl0ID0gZmxvYXRpbmdPYmplY3RTZXQuYmVnaW4oKTsgaXQg IT0gZW5kOyArK2l0KSB7Ci0gICAgICAgICAgICBGbG9hdGluZ09iamVjdCogciA9ICppdDsKLSAg ICAgICAgICAgIC8vIE9ubHkgcmVwYWludCB0aGUgb2JqZWN0IGlmIGl0IGlzIG92ZXJoYW5naW5n LCBpcyBub3QgaW4gaXRzIG93biBsYXllciwgYW5kCi0gICAgICAgICAgICAvLyBpcyBvdXIgcmVz cG9uc2liaWxpdHkgdG8gcGFpbnQgKG1fc2hvdWxkUGFpbnQgaXMgc2V0KS4gV2hlbiBwYWludEFs bERlc2NlbmRhbnRzIGlzIHRydWUsIHRoZSBsYXR0ZXIKLSAgICAgICAgICAgIC8vIGNvbmRpdGlv biBpcyByZXBsYWNlZCB3aXRoIGJlaW5nIGEgZGVzY2VuZGFudCBvZiB1cy4KLSAgICAgICAgICAg IGlmIChsb2dpY2FsQm90dG9tRm9yRmxvYXQocikgPiBsb2dpY2FsSGVpZ2h0KCkgJiYgKChwYWlu dEFsbERlc2NlbmRhbnRzICYmIHItPm1fcmVuZGVyZXItPmlzRGVzY2VuZGFudE9mKHRoaXMpKSB8 fCByLT5tX3Nob3VsZFBhaW50KSAmJiAhci0+bV9yZW5kZXJlci0+aGFzU2VsZlBhaW50aW5nTGF5 ZXIoKSkgewotICAgICAgICAgICAgICAgIHItPm1fcmVuZGVyZXItPnJlcGFpbnQoKTsKLSAgICAg ICAgICAgICAgICByLT5tX3JlbmRlcmVyLT5yZXBhaW50T3ZlcmhhbmdpbmdGbG9hdHMoKTsKLSAg ICAgICAgICAgIH0KKyAgICAvLyBGSVhNRTogQXZvaWQgZGlzYWJsaW5nIExheW91dFN0YXRlLiBB dCB0aGUgdmVyeSBsZWFzdCwgZG9uJ3QgZGlzYWJsZSBpdCBmb3IgZmxvYXRzIG9yaWdpbmF0aW5n CisgICAgLy8gaW4gdGhpcyBibG9jay4gQmV0dGVyIHlldCB3b3VsZCBiZSB0byBwdXNoIGV4dHJh IHN0YXRlIGZvciB0aGUgY29udGFpbmVycyBvZiBvdGhlciBmbG9hdHMuCisgICAgdmlldygpLT5k aXNhYmxlTGF5b3V0U3RhdGUoKTsKKyAgICBGbG9hdGluZ09iamVjdFNldCYgZmxvYXRpbmdPYmpl Y3RTZXQgPSBtX2Zsb2F0aW5nT2JqZWN0cy0+c2V0KCk7CisgICAgRmxvYXRpbmdPYmplY3RTZXRJ dGVyYXRvciBlbmQgPSBmbG9hdGluZ09iamVjdFNldC5lbmQoKTsKKyAgICBmb3IgKEZsb2F0aW5n T2JqZWN0U2V0SXRlcmF0b3IgaXQgPSBmbG9hdGluZ09iamVjdFNldC5iZWdpbigpOyBpdCAhPSBl bmQ7ICsraXQpIHsKKyAgICAgICAgRmxvYXRpbmdPYmplY3QqIHIgPSAqaXQ7CisgICAgICAgIC8v IE9ubHkgcmVwYWludCB0aGUgb2JqZWN0IGlmIGl0IGlzIG92ZXJoYW5naW5nLCBpcyBub3QgaW4g aXRzIG93biBsYXllciwgYW5kCisgICAgICAgIC8vIGlzIG91ciByZXNwb25zaWJpbGl0eSB0byBw YWludCAobV9zaG91bGRQYWludCBpcyBzZXQpLiBXaGVuIHBhaW50QWxsRGVzY2VuZGFudHMgaXMg dHJ1ZSwgdGhlIGxhdHRlcgorICAgICAgICAvLyBjb25kaXRpb24gaXMgcmVwbGFjZWQgd2l0aCBi ZWluZyBhIGRlc2NlbmRhbnQgb2YgdXMuCisgICAgICAgIGlmIChsb2dpY2FsQm90dG9tRm9yRmxv YXQocikgPiBsb2dpY2FsSGVpZ2h0KCkgJiYgKChwYWludEFsbERlc2NlbmRhbnRzICYmIHItPm1f cmVuZGVyZXItPmlzRGVzY2VuZGFudE9mKHRoaXMpKSB8fCByLT5tX3Nob3VsZFBhaW50KSAmJiAh ci0+bV9yZW5kZXJlci0+aGFzU2VsZlBhaW50aW5nTGF5ZXIoKSkgeworICAgICAgICAgICAgci0+ bV9yZW5kZXJlci0+cmVwYWludCgpOworICAgICAgICAgICAgci0+bV9yZW5kZXJlci0+cmVwYWlu dE92ZXJoYW5naW5nRmxvYXRzKCk7CiAgICAgICAgIH0KLSAgICAgICAgdmlldygpLT5lbmFibGVM YXlvdXRTdGF0ZSgpOwogICAgIH0KKyAgICB2aWV3KCktPmVuYWJsZUxheW91dFN0YXRlKCk7CiB9 CiAgCiB2b2lkIFJlbmRlckJsb2NrOjpwYWludChQYWludEluZm8mIHBhaW50SW5mbywgaW50IHR4 LCBpbnQgdHkpCkluZGV4OiBTb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQmxvY2suaAo9 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQmxvY2suaAkocmV2 aXNpb24gODYwNjEpCisrKyBTb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQmxvY2suaAko d29ya2luZyBjb3B5KQpAQCAtNTY4LDcgKzU2OCw3IEBAIHByaXZhdGU6CiAKICAgICB2aXJ0dWFs IGJvb2wgYXZvaWRzRmxvYXRzKCkgY29uc3Q7CiAKLSAgICBib29sIGhhc092ZXJoYW5naW5nRmxv YXRzKCkgeyByZXR1cm4gcGFyZW50KCkgJiYgIWhhc0NvbHVtbnMoKSAmJiBsb3dlc3RGbG9hdExv Z2ljYWxCb3R0b20oKSA+IGxvZ2ljYWxIZWlnaHQoKTsgfQorICAgIGJvb2wgaGFzT3Zlcmhhbmdp bmdGbG9hdHMoKSB7IHJldHVybiBwYXJlbnQoKSAmJiAhaGFzQ29sdW1ucygpICYmIGNvbnRhaW5z RmxvYXRzKCkgJiYgbG93ZXN0RmxvYXRMb2dpY2FsQm90dG9tKCkgPiBsb2dpY2FsSGVpZ2h0KCk7 IH0KICAgICB2b2lkIGFkZEludHJ1ZGluZ0Zsb2F0cyhSZW5kZXJCbG9jayogcHJldiwgaW50IHhv ZmZzZXQsIGludCB5b2Zmc2V0KTsKICAgICBpbnQgYWRkT3ZlcmhhbmdpbmdGbG9hdHMoUmVuZGVy QmxvY2sqIGNoaWxkLCBpbnQgeG9mZnNldCwgaW50IHlvZmZzZXQsIGJvb2wgbWFrZUNoaWxkUGFp bnRPdGhlckZsb2F0cyk7CiAKSW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDg2MTM1KQorKysgTGF5b3V0VGVz dHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTQgQEAKKzIwMTEtMDUtMTAg IEFiaGlzaGVrIEFyeWEgIDxpbmZlcm5vQGNocm9taXVtLm9yZz4KKworICAgICAgICBSZXZpZXdl ZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUZXN0cyB0aGF0IHdlIGRvIG5vdCBjcmFz aCBkdWUgdG8gd3JvbmcgcmVzdWx0IGZyb20KKyAgICAgICAgaGFzT3ZlcmhhbmdpbmdGbG9hdHMu CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD02MDUzNwor CisgICAgICAgICogZmFzdC9ibG9jay9mbG9hdC9uby1vdmVyaGFuZ2luZy1mbG9hdC1jcmFzaC1l eHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZhc3QvYmxvY2svZmxvYXQvbm8tb3Zlcmhh bmdpbmctZmxvYXQtY3Jhc2guaHRtbDogQWRkZWQuCisKIDIwMTEtMDUtMTAgIE1PUklUQSBIYWpp bWUgIDxtb3JyaXRhQGdvb2dsZS5jb20+CiAKICAgICAgICAgVW5yZXZpZXdlZCBmbGFraW5lc3Mg bWFya2luZyAodmlkZW8tY29udHJvbHMtcmVuZGVyaW5nLmh0bWwpCkluZGV4OiBMYXlvdXRUZXN0 cy9mYXN0L2Jsb2NrL2Zsb2F0L25vLW92ZXJoYW5naW5nLWZsb2F0LWNyYXNoLWV4cGVjdGVkLnR4 dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L2Jsb2NrL2Zsb2F0L25vLW92ZXJoYW5n aW5nLWZsb2F0LWNyYXNoLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3Rz L2Zhc3QvYmxvY2svZmxvYXQvbm8tb3ZlcmhhbmdpbmctZmxvYXQtY3Jhc2gtZXhwZWN0ZWQudHh0 CShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDIgQEAKK1BBU1MKKwpJbmRleDogTGF5b3V0VGVzdHMv ZmFzdC9ibG9jay9mbG9hdC9uby1vdmVyaGFuZ2luZy1mbG9hdC1jcmFzaC5odG1sCj09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT0KLS0tIExheW91dFRlc3RzL2Zhc3QvYmxvY2svZmxvYXQvbm8tb3ZlcmhhbmdpbmctZmxvYXQt Y3Jhc2guaHRtbAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Zhc3QvYmxvY2svZmxvYXQv bm8tb3ZlcmhhbmdpbmctZmxvYXQtY3Jhc2guaHRtbAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSwy MyBAQAorPGh0bWw+Cis8Ym9keSBvbmxvYWQ9InJ1blRlc3QoKSI+Cis8c2NyaXB0PgorICAgIGlm ICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpCisgICAgICAgIGxheW91dFRlc3RDb250cm9s bGVyLmR1bXBBc1RleHQoKTsKKyAgICAgICAgCisgICAgZnVuY3Rpb24gcnVuVGVzdCgpCisgICAg eyAKKyAgICAgICAgZG9jdW1lbnQuYm9keS5vZmZzZXRUb3A7CisgICAgICAgIHZhciBjaGlsZCA9 IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCd0ZXN0Jyk7CisgICAgICAgIGNoaWxkLnBhcmVudE5v ZGUucmVtb3ZlQ2hpbGQoY2hpbGQpOworICAgIH0KKzwvc2NyaXB0PgorPGRpdiBzdHlsZT0icGFk ZGluZy1ib3R0b206IDEwNTAwMDAwMDAwMDAwJTsgLXdlYmtpdC1jb2x1bW5zOiBpbml0aWFsOyI+ CisgICAgUEFTUworICAgIDxwPjwvcD4KKyAgICA8c3BhbiBpZD0idGVzdCI+CisgICAgICAgIDxs aW5rPjwvbGluaz4KKyAgICA8L3NwYW4+Cis8L2Rpdj4KKzwvYm9keT4KKzwvaHRtbD4KKwo=