69275 2011-10-03 11:54:24 -0700 Crash in IsolateTracker::addFakeRunIfNecessary(), preceded by assertion failure (m_nestedIsolateCount >= 1) in IsolateTracker::exitIsolate() 2011-11-29 12:37:30 -0800 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED data:text/html,%3Cspan%20style=%22unicode-bidi:%20-webkit-isolate;%22%3E%3Cspan%20style=%22unicode-bidi:%20-webkit-isolate;%22%3Ea%3C/span%3E%3C/span%3E%3Cbr%3E InRadar P1 Normal --- 69267 1 mitz rniwa eric leviw rniwa xji oldest_to_newest 477116 0 mitz 2011-10-03 11:54:24 -0700 To reproduce, navigate to the URL. Results: ASSERTION FAILED: m_nestedIsolateCount >= 1 Source/WebCore/rendering/InlineIterator.h(430) : void WebCore::IsolateTracker::exitIsolate() 1 WebCore::IsolateTracker::exitIsolate() 2 _ZN7WebCoreL28notifyObserverWillExitObjectINS_14IsolateTrackerEEEvPT_PNS_12RenderObjectE 3 _ZN7WebCoreL14bidiNextSharedINS_14IsolateTrackerEEEPNS_12RenderObjectES3_S3_PT_NS_19EmptyInlineBehaviorEPb 4 _ZN7WebCoreL28bidiNextSkippingEmptyInlinesINS_14IsolateTrackerEEEPNS_12RenderObjectES3_S3_PT_ 5 WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>::appendRun() 6 WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>::createBidiRunsForLine(WebCore::InlineIterator const&, WebCore::VisualDirectionOverride, bool) 7 _ZN7WebCoreL17constructBidiRunsERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERNS_11BidiRunListIS2_EERKS1_NS_23VisualDirectionOverrideEb 8 WebCore::RenderBlock::layoutRunsAndFloatsInRange(WebCore::LineLayoutState&, WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>&, WebCore::InlineIterator const&, WebCore::BidiStatus const&, unsigned int) 9 WebCore::RenderBlock::layoutRunsAndFloats(WebCore::LineLayoutState&, bool) 10 WebCore::RenderBlock::layoutInlineChildren(bool, int&, int&) 11 WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass) 12 WebCore::RenderBlock::layout() 13 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&) 14 WebCore::RenderBlock::layoutBlockChildren(bool, int&) 15 WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass) 16 WebCore::RenderBlock::layout() 17 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&) 18 WebCore::RenderBlock::layoutBlockChildren(bool, int&) 19 WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass) 20 WebCore::RenderBlock::layout() 21 WebCore::RenderView::layout() 22 WebCore::FrameView::layout(bool) 23 WebCore::Document::implicitClose() 24 WebCore::FrameLoader::checkCallImplicitClose() 25 WebCore::FrameLoader::checkCompleted() 26 WebCore::FrameLoader::finishedParsing() 27 WebCore::Document::finishedParsing() 28 WebCore::HTMLTreeBuilder::finished() 29 WebCore::HTMLDocumentParser::end() 30 WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd() 31 WebCore::HTMLDocumentParser::prepareToStopParsing() 477120 1 mitz 2011-10-03 12:03:16 -0700 It’s not clear to me why IsolateTracker initializes m_nestedIsolateCount to 1 regardless of the number of enclosing isolating inlines. 477125 2 mitz 2011-10-03 12:07:29 -0700 In release builds, this ends up crashing in IsolateTracker::addFakeRunIfNecessary(): Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000010 0 com.apple.WebCore 0x0000000107adc69d WebCore::IsolateTracker::addFakeRunIfNecessary(WebCore::RenderObject*, WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>&) + 113 1 com.apple.WebCore 0x00000001071a7536 WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>::appendRun() + 724 2 com.apple.WebCore 0x00000001071a701e WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>::createBidiRunsForLine(WebCore::InlineIterator const&, WebCore::VisualDirectionOverride, bool) + 3626 3 com.apple.WebCore 0x0000000107adae75 WebCore::RenderBlock::layoutRunsAndFloatsInRange(WebCore::LineLayoutState&, WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>&, WebCore::InlineIterator const&, WebCore::BidiStatus const&, unsigned int) + 1271 4 com.apple.WebCore 0x0000000107adbdde WebCore::RenderBlock::layoutRunsAndFloats(WebCore::LineLayoutState&, bool) + 1238 5 com.apple.WebCore 0x00000001071a1391 WebCore::RenderBlock::layoutInlineChildren(bool, int&, int&) + 425 6 com.apple.WebCore 0x0000000107ad25d7 WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass) + 1655 7 com.apple.WebCore 0x000000010719cab8 WebCore::RenderBlock::layout() + 42 8 com.apple.WebCore 0x000000010719f5f2 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&) + 838 9 com.apple.WebCore 0x000000010719e60a WebCore::RenderBlock::layoutBlockChildren(bool, int&) + 668 10 com.apple.WebCore 0x0000000107ad25f5 WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass) + 1685 11 com.apple.WebCore 0x000000010719cab8 WebCore::RenderBlock::layout() + 42 12 com.apple.WebCore 0x000000010719f5f2 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&) + 838 13 com.apple.WebCore 0x000000010719e60a WebCore::RenderBlock::layoutBlockChildren(bool, int&) + 668 14 com.apple.WebCore 0x0000000107ad25f5 WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass) + 1685 15 com.apple.WebCore 0x000000010719cab8 WebCore::RenderBlock::layout() + 42 16 com.apple.WebCore 0x000000010719ca1f WebCore::RenderView::layout() + 579 477127 3 mitz 2011-10-03 12:09:03 -0700 <rdar://problem/10212881> 477181 4 eric 2011-10-03 13:17:32 -0700 Thank you. 477530 5 eric 2011-10-04 04:10:43 -0700 (In reply to comment #1) > It’s not clear to me why IsolateTracker initializes m_nestedIsolateCount to 1 regardless of the number of enclosing isolating inlines. It's probably wrong. We simply don't have enough isolate test cases yet. 510026 6 rniwa 2011-11-28 11:44:30 -0800 Hm... I can't reproduce this crash on ToT. 510297 7 rniwa 2011-11-28 16:02:07 -0800 (In reply to comment #6) > Hm... I can't reproduce this crash on ToT. Apparently, I was doing it wrong. A patch coming in a minute. 510302 8 116847 rniwa 2011-11-28 16:07:47 -0800 Created attachment 116847 fixes the bug 510303 9 116847 rniwa 2011-11-28 16:08:30 -0800 Comment on attachment 116847 fixes the bug View in context: https://bugs.webkit.org/attachment.cgi?id=116847&action=review > Source/WebCore/ChangeLog:9 > + The crash was caused by our false assumption that at most one isolated container exits between the start s/exits/exists/ 510306 10 116847 leviw 2011-11-28 16:12:18 -0800 Comment on attachment 116847 fixes the bug Looks right to me :) 510395 11 116847 eric 2011-11-28 18:47:25 -0800 Comment on attachment 116847 fixes the bug Seems fine to me. I'm not sure I remember why I had that assumption. Clearly I designed the system to accommodate more than one. More test coverage will tell us if this is the right code design or not. :) 511012 12 rniwa 2011-11-29 12:37:30 -0800 Committed r101406: <http://trac.webkit.org/changeset/101406> 116847 2011-11-28 16:07:47 -0800 2011-11-28 18:47:25 -0800 fixes the bug bug-69275-20111128160746.patch text/plain 4888 rniwa SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDEwMTI5OCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIyIEBACisyMDExLTExLTI4ICBSeW9zdWtl IE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIENyYXNoIGluIElzb2xhdGVUcmFj a2VyOjphZGRGYWtlUnVuSWZOZWNlc3NhcnkoKSwgcHJlY2VkZWQgYnkgYXNzZXJ0aW9uIGZhaWx1 cmUgKG1fbmVzdGVkSXNvbGF0ZUNvdW50ID49IDEpCisgICAgICAgIGluIElzb2xhdGVUcmFja2Vy OjpleGl0SXNvbGF0ZSgpCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD02OTI3NQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg ICAgICAgIFRoZSBjcmFzaCB3YXMgY2F1c2VkIGJ5IG91ciBmYWxzZSBhc3N1bXB0aW9uIHRoYXQg YXQgbW9zdCBvbmUgaXNvbGF0ZWQgY29udGFpbmVyIGV4aXRzIGJldHdlZW4gdGhlIHN0YXJ0Cisg ICAgICAgIGFuZCB0aGUgcm9vdCB3aGVuIGFwcGVuZGluZyBhIG5ldyBydW4uIEZpeGVkIHRoZSBj cmFzaCBieSBjb21wdXRpbmcgdGhlIGFjdHVhbCBudW1iZXIgb2YgaXNvbGF0ZWQgY29udGFpbmVy cworICAgICAgICBiZXR3ZWVuIHRoZSBzdGFydCBhbmQgdGhlIHJvb3QuCisKKyAgICAgICAgVGVz dDogZmFzdC90ZXh0L25lc3RlZC1iaWRpLWlzb2xhdGUtY3Jhc2guaHRtbAorCisgICAgICAgICog cmVuZGVyaW5nL0lubGluZUl0ZXJhdG9yLmg6CisgICAgICAgIChXZWJDb3JlOjpudW1iZXJPZklz b2xhdGVBbmNlc3RvcnMpOgorICAgICAgICAoV2ViQ29yZTo6SXNvbGF0ZVRyYWNrZXI6Oklzb2xh dGVUcmFja2VyKToKKyAgICAgICAgKFdlYkNvcmU6OklubGluZUJpZGlSZXNvbHZlcjo6YXBwZW5k UnVuKToKKwogMjAxMS0xMS0yOCAgQmV0aCBEYWtpbiAgPGJkYWtpbkBhcHBsZS5jb20+CiAKICAg ICAgICAgU3BlY3VsYXRpdmUgQ2hyb21pdW0gYnVpbGQtZml4LgpJbmRleDogU291cmNlL1dlYkNv cmUvcmVuZGVyaW5nL0lubGluZUl0ZXJhdG9yLmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNv cmUvcmVuZGVyaW5nL0lubGluZUl0ZXJhdG9yLmgJKHJldmlzaW9uIDEwMTI3NSkKKysrIFNvdXJj ZS9XZWJDb3JlL3JlbmRlcmluZy9JbmxpbmVJdGVyYXRvci5oCSh3b3JraW5nIGNvcHkpCkBAIC00 MDYsNiArNDA2LDE4IEBAIHN0YXRpYyBpbmxpbmUgUmVuZGVyT2JqZWN0KiBjb250YWluaW5nSXMK ICAgICByZXR1cm4gMDsKIH0KIAorc3RhdGljIGlubGluZSB1bnNpZ25lZCBudW1iZXJPZklzb2xh dGVBbmNlc3RvcnMoUmVuZGVyT2JqZWN0KiBvYmplY3QsIFJlbmRlck9iamVjdCogcm9vdCkKK3sK KyAgICBBU1NFUlQob2JqZWN0KTsKKyAgICB1bnNpZ25lZCBjb3VudCA9IDA7CisgICAgd2hpbGUg KG9iamVjdCAmJiBvYmplY3QgIT0gcm9vdCkgeworICAgICAgICBpZiAoaXNJc29sYXRlZElubGlu ZShvYmplY3QpKQorICAgICAgICAgICAgY291bnQrKzsKKyAgICAgICAgb2JqZWN0ID0gb2JqZWN0 LT5wYXJlbnQoKTsKKyAgICB9CisgICAgcmV0dXJuIGNvdW50OworfQorCiAvLyBGSVhNRTogVGhp cyBiZWxvbmdzIG9uIElubGluZUJpZGlSZXNvbHZlciwgZXhjZXB0IGl0J3MgYSB0ZW1wbGF0ZSBz cGVjaWFsaXphdGlvbgogLy8gb2YgQmlkaVJlc29sdmVyIHdoaWNoIGtub3dzIG5vdGhpbmcgYWJv dXQgUmVuZGVyT2JqZWN0cy4KIHN0YXRpYyBpbmxpbmUgdm9pZCBhZGRQbGFjZWhvbGRlclJ1bkZv cklzb2xhdGVkSW5saW5lKElubGluZUJpZGlSZXNvbHZlciYgcmVzb2x2ZXIsIFJlbmRlck9iamVj dCogaXNvbGF0ZWRJbmxpbmUpCkBAIC00MjAsOCArNDMyLDggQEAgc3RhdGljIGlubGluZSB2b2lk IGFkZFBsYWNlaG9sZGVyUnVuRm9ySQogCiBjbGFzcyBJc29sYXRlVHJhY2tlciB7CiBwdWJsaWM6 Ci0gICAgZXhwbGljaXQgSXNvbGF0ZVRyYWNrZXIoYm9vbCBpbklzb2xhdGUpCi0gICAgICAgIDog bV9uZXN0ZWRJc29sYXRlQ291bnQoaW5Jc29sYXRlID8gMSA6IDApCisgICAgZXhwbGljaXQgSXNv bGF0ZVRyYWNrZXIodW5zaWduZWQgbmVzdGVkSXNvbGF0ZUNvdW50KQorICAgICAgICA6IG1fbmVz dGVkSXNvbGF0ZUNvdW50KG5lc3RlZElzb2xhdGVDb3VudCkKICAgICAgICAgLCBtX2hhdmVBZGRl ZEZha2VSdW5Gb3JSb290SXNvbGF0ZShmYWxzZSkKICAgICB7CiAgICAgfQpAQCAtNDcwLDcgKzQ4 Miw3IEBAIGlubGluZSB2b2lkIElubGluZUJpZGlSZXNvbHZlcjo6YXBwZW5kUnUKICAgICAgICAg Ly8gS2VlcCB0cmFjayBvZiB3aGVuIHdlIGVudGVyL2xlYXZlICJ1bmljb2RlLWJpZGk6IGlzb2xh dGUiIGlubGluZXMuCiAgICAgICAgIC8vIEluaXRpYWxpemUgb3VyIHN0YXRlIGRlcGVuZGluZyBv biBpZiB3ZSdyZSBzdGFydGluZyBpbiB0aGUgbWlkZGxlIG9mIHN1Y2ggYW4gaW5saW5lLgogICAg ICAgICAvLyBGSVhNRTogQ291bGQgdGhpcyBpbml0aWFsaXplIGZyb20gdGhpcy0+aW5Jc29sYXRl KCkgaW5zdGVhZCBvZiB3YWxraW5nIHVwIHRoZSByZW5kZXIgdHJlZT8KLSAgICAgICAgSXNvbGF0 ZVRyYWNrZXIgaXNvbGF0ZVRyYWNrZXIoY29udGFpbmluZ0lzb2xhdGUobV9zb3IubV9vYmosIG1f c29yLnJvb3QoKSkpOworICAgICAgICBJc29sYXRlVHJhY2tlciBpc29sYXRlVHJhY2tlcihudW1i ZXJPZklzb2xhdGVBbmNlc3RvcnMobV9zb3IubV9vYmosIG1fc29yLnJvb3QoKSkpOwogICAgICAg ICBpbnQgc3RhcnQgPSBtX3Nvci5tX3BvczsKICAgICAgICAgUmVuZGVyT2JqZWN0KiBvYmogPSBt X3Nvci5tX29iajsKICAgICAgICAgd2hpbGUgKG9iaiAmJiBvYmogIT0gbV9lb3IubV9vYmogJiYg b2JqICE9IGVuZE9mTGluZS5tX29iaikgewpJbmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT0KLS0tIExheW91dFRlc3RzL0NoYW5nZUxvZwkocmV2aXNpb24gMTAxMjk4KQorKysg TGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTYgQEAKKzIw MTEtMTEtMjggIFJ5b3N1a2UgTml3YSAgPHJuaXdhQHdlYmtpdC5vcmc+CisKKyAgICAgICAgQ3Jh c2ggaW4gSXNvbGF0ZVRyYWNrZXI6OmFkZEZha2VSdW5JZk5lY2Vzc2FyeSgpLCBwcmVjZWRlZCBi eSBhc3NlcnRpb24gZmFpbHVyZSAobV9uZXN0ZWRJc29sYXRlQ291bnQgPj0gMSkKKyAgICAgICAg aW4gSXNvbGF0ZVRyYWNrZXI6OmV4aXRJc29sYXRlKCkKKyAgICAgICAgaHR0cHM6Ly9idWdzLndl YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTY5Mjc1CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9C T0RZIChPT1BTISkuCisKKyAgICAgICAgQWRkIGEgcmVncmVzc2lvbiB0ZXN0LgorCisgICAgICAg ICogZmFzdC90ZXh0L25lc3RlZC1iaWRpLWlzb2xhdGUtY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRl ZC4KKyAgICAgICAgKiBmYXN0L3RleHQvbmVzdGVkLWJpZGktaXNvbGF0ZS1jcmFzaC5odG1sOiBB ZGRlZC4KKwogMjAxMS0xMS0yOCAgS2VudGFybyBIYXJhICA8aGFyYWtlbkBjaHJvbWl1bS5vcmc+ CiAKICAgICAgICAgVW5yZXZpZXdlZCwgcy9TeW50YXhFcnJvci9UeXBlRXJyb3IvIGluIHRoZSBm bGFreSB0ZXN0IHJlc3VsdC4KSW5kZXg6IExheW91dFRlc3RzL2Zhc3QvdGV4dC9uZXN0ZWQtYmlk aS1pc29sYXRlLWNyYXNoLWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9m YXN0L3RleHQvbmVzdGVkLWJpZGktaXNvbGF0ZS1jcmFzaC1leHBlY3RlZC50eHQJKHJldmlzaW9u IDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L3RleHQvbmVzdGVkLWJpZGktaXNvbGF0ZS1jcmFzaC1l eHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsNCBAQAorVGhpcyB0ZXN0cyBuZXN0 aW5nIHR3byBzcGFucyB3aXRoIC13ZWJraXQtaXNvbGF0ZSBmb2xsb3dlZCBieSBhIGJyLiBUaGUg dGVzdCBwYXNzZXMgaWYgV2ViS2l0IGRvZXNuJ3QgY3Jhc2guCisKK2EKKwpJbmRleDogTGF5b3V0 VGVzdHMvZmFzdC90ZXh0L25lc3RlZC1iaWRpLWlzb2xhdGUtY3Jhc2guaHRtbAo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L3RleHQvbmVzdGVkLWJpZGktaXNvbGF0ZS1jcmFzaC5odG1s CShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvZmFzdC90ZXh0L25lc3RlZC1iaWRpLWlzb2xh dGUtY3Jhc2guaHRtbAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSw5IEBACis8IURPQ1RZUEUgaHRt bD4KKzxwPlRoaXMgdGVzdHMgbmVzdGluZyB0d28gc3BhbnMgd2l0aCAtd2Via2l0LWlzb2xhdGUg Zm9sbG93ZWQgYnkgYSBici4gVGhlIHRlc3QgcGFzc2VzIGlmIFdlYktpdCBkb2Vzbid0IGNyYXNo LjwvcD4KKzxzcGFuIHN0eWxlPSJ1bmljb2RlLWJpZGk6LXdlYmtpdC1pc29sYXRlOyI+PHNwYW4g c3R5bGU9InVuaWNvZGUtYmlkaTotd2Via2l0LWlzb2xhdGU7Ij5hPC9zcGFuPjwvc3Bhbj48YnI+ Cis8c2NyaXB0PgorCitpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKQorICAgIGxheW91 dFRlc3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKKworPC9zY3JpcHQ+Cg==